About chiltonb

chiltonb · ‎02-07-2017

That worked, I didn't type search in the "Open in view" box, I thought that it would have been a drop down selection. Thanks!

chiltonb · ‎02-06-2017

Correct im in Incident Review, I then go to actions and then to the workflow I have created. The work flow is set to open in a new window.

chiltonb · ‎02-06-2017

I have made a workflow action item that looks up details on an IP address when there is a threat hit. This works when it is ran from the Search and Reporting app, but when I try to run it from the Incident Review page within Splunk Enterprise Security (ES) it defaults back to ES and does not open it in a new search. Does anyone know why this won't allow me to open in a new search?

chiltonb · ‎02-06-2017

All I had to do was add the |eval urgency="critical" that did the job. Thanks!

chiltonb · ‎01-31-2017

Is there a way to force a notable event in Splunk Enterprise Security to be critical? We have certain notables that are created that are only registered as a high and we want to force them to be critical. Is there a way to accomplish this? Thanks,

Posts	5
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎10-12-2016

Online Status	Offline
Date Last Visited	‎06-18-2021 11:32 AM

Splunk Enterprise Security: Why won't a workflow a...

Splunk Enterprise Security: Is there a way to forc...

Re: Splunk Enterprise Security: Why won't a workfl...

Re: Splunk Enterprise Security: Why won't a workfl...

Splunk Enterprise Security: Why won't a workflow a...

Re: Splunk Enterprise Security: Is there a way to ...

Splunk Enterprise Security: Is there a way to forc...