I'm a new Splunk customer and I'm wondering the same thing. How can I auto refresh the notables in Incident Review?? Think of an analyst monitoring for notables while also doing another task. Click...wait...click...wait...click....wait.....hopefully you get the point. Clicking refresh every minute and\or monitoring a dashboard that you can't interact with to directly assign ownership or change status of a notable are both inefficient and prone for missed SLAs. This seems like it would be a simple use case to solve. Seeing as though I'm bumping into the same "issue" as other customers years later is concerning. I'd be happy to share my thoughts with a Splunk UX decision maker to provide more information as to why this would be a useful feature for Splunk users.
... View more
