https://community.splunk.com/t5/Getting-Data-In/Creating-sequence-templates-in-Splunk/m-p/538451#M90241 <P>Hi all,</P><P>I want to create a Sequent template &nbsp;that triggers when two correlation searches triggers for the same source IP.</P><UL><LI>Correlation Search 1: EDR Detection</LI><LI>Correlation Search 2: Traffic to suspicious URL</LI><LI>Fields of Interest from Correlation Search 1:Source IP, File Name, File Path, File Hash etc</LI><LI>Fields of Interest from Correlation Search 2:Source IP, URL, URL_Domain, Destination IP etc</LI></UL><P>How can I get the fields of interest from correlation search 2 in the sequenced events? The ‘Output Fields’ session in the Sequence template is accepting only the ‘status labels’ defined in the ‘start’ session(ie, fields from Correlation Search 1).</P> Wed, 03 Feb 2021 12:50:39 GMT VidhyaChris 2021-02-03T12:50:39Z https://community.splunk.com/t5/Getting-Data-In/Creating-sequence-templates-in-Splunk/m-p/538451#M90241 <P>Hi all,</P><P>I want to create a Sequent template &nbsp;that triggers when two correlation searches triggers for the same source IP.</P><UL><LI>Correlation Search 1: EDR Detection</LI><LI>Correlation Search 2: Traffic to suspicious URL</LI><LI>Fields of Interest from Correlation Search 1:Source IP, File Name, File Path, File Hash etc</LI><LI>Fields of Interest from Correlation Search 2:Source IP, URL, URL_Domain, Destination IP etc</LI></UL><P>How can I get the fields of interest from correlation search 2 in the sequenced events? The ‘Output Fields’ session in the Sequence template is accepting only the ‘status labels’ defined in the ‘start’ session(ie, fields from Correlation Search 1).</P> Wed, 03 Feb 2021 12:50:39 GMT https://community.splunk.com/t5/Getting-Data-In/Creating-sequence-templates-in-Splunk/m-p/538451#M90241 VidhyaChris 2021-02-03T12:50:39Z