To share an investigation with someone that does not use , such as for auditing purposes, you can print any investigation or save any investigation as a PDF.
- From the investigation, click the icon. generates a formatted version of the investigation timeline with entries in chronological order. The order of the entries in the printout remains in the original order, even if you manually edit the times so that they show up differently in the user interface.
- Print the investigation or save it as a PDF using the print dialog box options.
Review an investigation in Splunk Enterprise Security
Refer to your action history in Splunk Enterprise Security
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.1