Is there a way to automatically close all of the notables associated with an investigation when you close the investigation itself?  Currently Splunk just gives me a warning that "x number of notables are still open in this investigation."  The only way i have found to close notables is to go back to the "incident review" interface and manually filter and then change their state to closed.  This seems like an unnecessary step if I'm already closing the investigation.  Am i missing something?  ... View more