Splunk Enterprise Security: Why is the notable event for a user lockout correlation search showing urgency as "Unknown"?

[kiran331]

Hi

The notable event for a user lockout correlation search is showing urgency as "Unknown", I tried changing it to Medium, but that is even showing as "Unknown".

Correlation search using:

| datamodel "Change_Analysis" "Account_Lockouts" search | where 'All_Changes.result_id'=4740 | eval tag=mvjoin(tag,"|") | localop | eval severity=if(severity = "Severe","Medium",severity)| rename "_time" as "orig_time","_raw" as "orig_raw","linecount" as "orig_linecount","eventtype" as "orig_eventtype","splunk_server" as "orig_splunk_server","tag" as "orig_tag","timestartpos" as "orig_timestartpos","timeendpos" as "orig_timeendpos"| fields - date_*,punct | eval const_dedup_id="const_dedup_id"

[aholzel · Accepted solution]

What version of ES are you using because I also had a problem with this and it was fixed when we updated to 4.0.1 also you can have a look here: http://docs.splunk.com/Documentation/ES/4.2.0/User/NotableEvents#How_urgency_is_assigned_to_notable_... to see how the urgency is calculated.