Splunk Search

Entering comments into a notable event - possible?

shiftey
Path Finder

Hi Splunk Answers,

I understand that notable events can be assigned severity as well as being assigned to different analysts.

Is it possible to update an event with comments. This would be useful so the analyst working on the event can enter useful information before assigning to another analyst.

Thanks

0 Karma

LukeMurphey
Champion

You do this by entering by editing the event and entering only a comment. Leave the other fields empty and it not change those items (will leave the status, urgency and owner unchanged).

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...