Start an investigation in Splunk Enterprise Security

You can start an investigation in several ways in .

• Start an investigation from Incident Review while triaging notable events. See Add a notable event to an investigation.
• Start an investigation with an event workflow action. See Add a Splunk event to an investigation.
• Start an investigation from the Investigations dashboard.
• Start an investigation when viewing a dashboard using the investigation bar.

By default, users with the ess_admin and ess_analyst roles can start an investigation.

Start an investigation from the Investigations dashboard

Start an investigation from the Investigations dashboard.

1. Click Create New Investigation.
2. Type a title.
3. (Optional) Type a description.
4. Click Save.

Start an investigation from the investigation bar

When viewing dashboards in , you can see an investigation bar at the bottom of the page. You can use the investigation bar to track your investigation progress from any page in .

1. Click the icon to create an investigation.
2. Type a title.
3. (Optional) Type a description.
4. Click Save.

The investigation is loaded in the investigation bar.