Splunk Enterprise Security

Delete notable event history?

daniel333
Builder

All,

How can I delete the notable event history? Nothing in there I care about. We had a few were testing and now they are in the history looking misleading.

0 Karma

LukeMurphey
Champion

You can use ES' Notable Event Suppression to get them out of Incident Review. Suppressions don't delete the events per se, but it will drop them out of your view. See the docs here: http://docs.splunk.com/Documentation/ES/5.1.0/Admin/Customizenotables#Create_a_suppression_from_Nota...

When you create the suppression, you will want to set a date such that it suppresses all of the notables before the given date (probably today in your case).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...