Splunk Search

Entering comments into a notable event - possible?

shiftey
Path Finder

Hi Splunk Answers,

I understand that notable events can be assigned severity as well as being assigned to different analysts.

Is it possible to update an event with comments. This would be useful so the analyst working on the event can enter useful information before assigning to another analyst.

Thanks

0 Karma

LukeMurphey
Champion

You do this by entering by editing the event and entering only a comment. Leave the other fields empty and it not change those items (will leave the status, urgency and owner unchanged).

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...