Splunk Enterprise Security

Splunk Enterprise Security (ES) - How to do a field lookup for Notable Events?

JohannLiebert92
Path Finder

Hi everyone,

I am creating a workflow action that allows me to links to a website (e.g. google.com) from Incident Review dashboard. The problem is, in order to use the workflow action, I need to pass a field that is available from a lookup file (based on event_id). May I know how to do lookup for the notable events?

Thanks

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable macro... that macro makes sure the event_id is computed, and therefore your lookup can only be added afterwards.

Then you can use the lookup's output fields in your workflow action as usual.

Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you intend to use the workflow action from Incident Review or similar pages, that lookup would need to be called from within the notable macro... that macro makes sure the event_id is computed, and therefore your lookup can only be added afterwards.

Then you can use the lookup's output fields in your workflow action as usual.

Caution: Make sure any changes to the default macro made in any upgrade of ES versions also gets replicated in your local copy.

JohannLiebert92
Path Finder

Ah I see..thanks for the detailed explanations!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...