Splunk® Enterprise Security

Install and Upgrade Splunk Enterprise Security

This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.

Configure log review settings

Log review settings are associated with editing the status of notable events. Go to Configure > Log Review Settings to configure whether analysts can override the calculated urgency, and if a comment is required when a status change is made.

Es-log review settings.png

  • Allow Overriding of Urgency: This is on by default and allows analysts to override the calculated urgency of a notable event. If it is disabled, the calculated urgency may not be changed.
  • Comment Required: If this is enabled, the length of the required comment can be specified.

Click Save when configuration is complete.

Last modified on 29 January, 2013
Notable event suppression   Security Posture dashboard

This documentation applies to the following versions of Splunk® Enterprise Security: 3.0, 3.0.1

Acrobat logo Download manual
Acrobat logo Download this page

Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters