Thanks Martin, Your solution works, just keeping in mind that the earliest and latest fields have to be always present in the request. ... View more

I couldn't build the ULR with the actual event ID pointing to the Incident Review Dashboard. There are few ways to accomplish this as far as I know: using the short ID as unique identifier of the notable event and create the get request with the association fields: Eg. https://a.b.c.d:8000/en-US/app/SplunkEnterpriseSecuritySuite/incident_review?**form.association_type**=short_id&**form.association_id**=KA2E6L passing all form fields to query an specific notable event, with the earliest and latest fields in epoch format, and the the precision of the time is very important. Otherwise, you could get 2 or more events in between the given time period (earliest and latest) >>> I really don't like this option. Eg: https://a.b.c.d:8000/en-US/app/SplunkEnterpriseSecuritySuite/incident_review?earliest=1519399455&latest=1519399809.3032&form.status_form=*&form.owner_form=*&form.security_domain_form=*&form.srch=&form.selected_urgency=critical So, for option 1 a Short ID have to be created (via Create Short ID or Share Notable Event). I would like to know how to automatically generate the Short ID (not clicking on it) Any suggestions are welcome.. thanks ... View more