Splunk Enterprise Security
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

How to duplicate Notables in ES Incident Review?

VK18
Explorer
‎03-28-2023 10:20 PM

Hi All,

How can we stop duplicate notables which are getting generated in the Incident Review page for same event id in the Enterprise security . Do we need to adjust any settings ?

Time range 
Earliest = -70M
Latest = -10M

Cron schedule : every 35 Minutes

It's happening for all correlation searches .

Regards
VK

 

Labels (1)
Labels
0 Karma
Reply
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...