topic Re: Notables Are Not Getting Created in Other Usage

Notables Are Not Being Created

daniaabujuma — Wed, 06 Sep 2023 12:07:44 GMT

Hi Splunkers!

I am using Splunk Enterprise Security, and creating correlation searches, one of them I have created and tested manually by running the search over a specific period of time, many events matched, but no notable events are being created. To test my correlation, I have added another action (send email) when the correlation is triggered, and sure enough, an email was sent to me.

Can anyone help me solve this issue?

Re: Notables Are Not Getting Created

gcusello — Wed, 06 Sep 2023 12:01:28 GMT

Hi @daniaabujuma,

a very stupid question: did you created as Requested Action the Notable creation?

Notable Creation isn't enabled by default.

If yes, check the parameters you used.

Ciao.

Giuseppe

Re: Notables Are Not Getting Created

daniaabujuma — Wed, 06 Sep 2023 12:05:28 GMT

Hi @gcusello ,

Thanks for the reply.

This is what I did, it works every time without issues but I noticed that recently the newly created correlations aren't creating notables when triggered.

Re: Notables Are Not Getting Created

gcusello — Wed, 06 Sep 2023 12:08:47 GMT

Hi @daniaabujuma,

check if the options in the Notable crattion are the same of other Notables that are usually triggered.

Ciao.

Giuseppe

Re: Notables Are Not Getting Created

daniaabujuma — Wed, 06 Sep 2023 12:25:37 GMT

Hello @gcusello ,

Yes everything is the exact same

Re: Notables Are Not Getting Created

gcusello — Wed, 06 Sep 2023 12:28:26 GMT

Hi @daniaabujuma,

check the Correlation Search Name: it must be different than others, otherwise you cannot distinguish it from the others.

Ciao.

Giuseppe