Splunk Enterprise Security

Splunk Enterprise Security (ES) - How to do a field lookup for Notable Events?

JohannLiebert92
Path Finder

Hi everyone,

I am creating a workflow action that allows me to links to a website (e.g. google.com) from Incident Review dashboard. The problem is, in order to use the workflow action, I need to pass a field that is available from a lookup file (based on event_id). May I know how to do lookup for the notable events?

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable macro... that macro makes sure the event_id is computed, and therefore your lookup can only be added afterwards.

Then you can use the lookup's output fields in your workflow action as usual.

Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable macro... that macro makes sure the event_id is computed, and therefore your lookup can only be added afterwards.

Then you can use the lookup's output fields in your workflow action as usual.

Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.

JohannLiebert92
Path Finder

Ah I see..thanks for the detailed explanations!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...