Hello! I need some help from splunkers!!!   I'm using the search index=notable | search status_label=Closed | top limit=5 rule_title in the Splunk Enterprise Security, to list top 10 rule_title values.   But i need to bring the field "comment" of each rule_title in the table.   Can please help me?   Tks!!! ... View more

I would like a search query that would display a graph with the number of closed notables divided by urgency in the last 12 hours, but the notables need to be retrieved based on the time they were closed. I'm using this search: | inputlookup append=T incident_review_lookup | rename user as reviewer | `get_realname(owner)` | `get_realname(reviewer)` | eval nullstatus=if(isnull(status),"true","false") | `get_reviewstatuses` | eval status=if((isnull(status) OR isnull(status_label)) AND nullstatus=="false",0,status) | eval status_label=if(isnull(status_label) AND nullstatus=="false","Unassigned",status_label) | eval status_description=if(isnull(status_description) AND nullstatus=="false","unknown",status_description) | eval _time=time | `uitime(time)` | fields - nullstatus     What's wrong? ... View more