Parent-child relationships in Splunk Mission Control are currently released as a preview feature. Preview features are provided by Splunk to you "as is" without any warranties, maintenance and support, or service level commitments. Splunk makes this preview feature available in its sole discretion and may discontinue it at any time. Use of preview features is subject to the Splunk General Terms.

Group incidents by creating parent-child relationships in Splunk Mission Control

Sometimes multiple incidents are part of one security incident with the same root cause. You can investigate these related incidents, compare their data, and update some of their fields simultaneously by creating a parent-child relationship between the incidents. A parent-child incident group is a hierarchy where one primary incident, or the parent incident, has one or more related secondary incidents, or child incidents. Grouping incidents can help reduce the time you spend updating each incident investigation and also help you resolve incidents faster. You can add up to 100 child incidents to a parent incident.

Adding more than 50 child incidents to a parent incident can impact the performance of the parent incident investigation pages. Data such as summary fields and risk events might take several seconds to appear.

Add child incidents to a parent incident

You can group incidents together from the incident review page of Splunk Mission Control, or you can do so while investigating an incident.

To add one or more child incidents to a parent incident from the incident review page, complete the following steps:

1. Navigate to the Incident review page in Splunk Mission Control.
2. Select one or more incidents to add to another incident. The incidents you select from the incident review page become the child incidents.
   1. To select multiple incidents, check their respective check boxes.
   2. To select a single incident, hover over the incident and then select the more icon ( ).

      You can only select incidents with no existing parent-child relationship to add to another incident.

3. Select Add to incident.
4. Select a parent incident to assign to the child incidents you already selected. For the parent incident, you can choose to either Create new incident or Add to existing incident.
5. If you want to create a new parent incident, give it a name and then set the fields using the drop-down lists.
6. If you want to select an existing parent incident, use the drop-down list to choose an incident. You can browse your recent incidents or search for an incident by name, incident ID, or reference ID.
7. (Optional) Select whether or not you want the owner, status, urgency, sensitivity, and disposition fields for child incidents to mirror that of their parent incident. For example, if you select this option, changing the status of a parent incident from New to Pending automatically makes the same change to the status of all related child incidents.
8. Select Save.

To add the incident you're investigating to a parent incident, complete the following steps:

1. From the investigation of a particular incident, select the more icon ().
2. Select Add to incident. The incident you're investigating becomes the child incident.

   You can only add an incident to another one if both incidents have no existing parent-child relationship.

3. Select a parent incident to assign to the child incident. For the parent incident, you can choose to either Create new incident or Add to existing incident.
4. If you want to create a new parent incident, give it a name and then set the fields using the drop-down lists.
5. If you want to select an existing parent incident, use the drop-down list to choose an incident. You can browse your recent incidents or search for an incident by name, incident ID, or reference ID.
6. (Optional) Select whether or not you want the owner, status, urgency, sensitivity, and disposition fields for the child incident to mirror that of their parent incident. For example, if you select this option, changing the status of a parent incident from New to Pending automatically makes the same change to the status of all related child incidents.

After you add one or more child incidents to a parent incident, you can see the relationship between the incidents in the incident review table. On the Incident review page, expand an incident with a parent icon ( ) to see its related child incidents denoted by the child icon ( ).

Review details about incidents in a parent-child relationship

If you're investigating an incident and you want to open the investigation of a related parent or child incident, complete the following steps:

1. Select the Overview tab
2. Expand the Parent incident or Child incident section. An incident investigation has one or the other depending on which incident you're viewing.
3. Select the incident you want to investigate.