Notes¶

Notes are free-form, Markdown annotations you attach to an entity — the running log of what is going on with this thing and what we did about it. They are perfect for investigation context, runbook and ticket links, workarounds, and hand-offs between shifts, without cluttering the entity’s structured fields. Notes are available on all six components.

What a note is¶

Free-form Markdown — links, lists, tables, code fences, and inline formatting all render in the entity’s Notes panel.
Per entity, multi-note — an entity can carry any number of notes, shown newest first; they are never merged or deduplicated.
Authored — every note records who created it and when.
Immutable — there is no edit action. To change a note you delete it and create a new one; the audit trail records both. Each note card offers only clone and delete.

Anyone can read notes; creating, cloning, and deleting them requires the power role.

A note card showing its author and timestamp, with clone and delete actions

Markdown, links, and reports¶

Because notes are rendered as Markdown, they are far more than a comment box. Drop in a runbook or ticket link ([INC-1234](https://…)), a checklist, a table, or a fenced command. It is even a natural home for an AI Advisor investigation — save its report as a note and the whole team has the context:

Note

TrackMe renders your Markdown as-is and does not sanitise it — write Markdown, and do not paste untrusted HTML.

Creating, expiring, and cloning notes¶

When you add a note you choose a validity period — Permanent, or an expiry of up to 365 days. An expiring note shows an “Expires on …” badge and is automatically purged once it lapses, so time-boxed context (“waiting on the vendor until Friday”) cleans itself up. Permanent notes are never purged.

Adding a note, choosing its Markdown text and validity period

A note can also be cloned to many entities at once — the picker copies the note’s text to every entity you select, and each target gets its own independent note (so editing or deleting one never affects the others). This is the quick way to spread the same context across a set of related entities; cloned notes are created permanent.

The Global Note & documentation link¶

Above the note list, each entity also has a single Global Note and a documentation link — the home for the one canonical description and the one runbook or wiki URL for that entity. Unlike the timestamped notes below it, the Global Note is a single editable field, and the documentation link renders as a clickable link. (This is the evolution of the old “Documentation Notes & Links” / identity-card feature; an entity-specific value overrides the tenant-wide default.) Programmatically it is served by the splk_identity_cards resource group — reads require the trackmeuseroperations capability and splk_identity_cards/write requires trackmepoweroperations.

Where notes appear — and where they don’t¶

Notes live on the entity: open them from the entity, or from the Notes action in the entities table, which also shows a note count per entity.

The entities table showing a note count on an entity

Notes are searchable by substring inside the panel, but — unlike labels and tags — they are not a filter axis or a group-by. Use notes for context a human reads; use labels and tags for structured filtering.
Notes are not included in alerts or notable events, and they never affect an entity’s score or state. (An acknowledgment carries its own separate comment — that is not a note.)

Tip

Notes vs the entity description. A note is a timestamped, authored, append-only log entry. If you instead want a single, editable-in-place description of the entity, edit its object_description field (or the Global Note above) rather than adding a note.