Incident Review -> History page is empty

[VK18]

Hi Team,

We're encountering a problem with the Incident Review History tab in Splunk ES. Clicking on Incident Review, then a specific notable (like 'Tunnelling Via DNS'), followed by History and clicking 'View all review activity for this Notable Event', results in an empty history being displayed for all the notables.

Any leads on this would be highly appreciated.

Note : Recently, we have upgraded to Splunk ES to 7.1.2 from 7.0.0

Regards
VK18 

[venkatasri]

Hi @VK18 ,

If the notable is new and not being worked on by analysts/concerned team then you would find empty results. Check for notable that has been changed from New to other status such as 'In progress' or closed. You should be able to find the history.

-----

Srikanth Yarlagadda

[VK18]

Thanks Srinivas for your reply.

We've designated 'New' as the default status for all notables.

I attempted to set 'In Progress' as the default status by adjusting the status configuration. Afterward, I reviewed the Incident page, specifically the 'Notables' section under 'History View,' to check all activity related to this notable event. However, the History yielded empty results.

And, when I did debug on the search, It is unable to find the marked rule_id in the notables. Is this expected ?

Any help will be highly appreciated