topic Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? in Splunk Enterprise Security https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282646#M2360 <P>savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.</P> Wed, 08 Feb 2017 19:42:32 GMT starcher 2017-02-08T19:42:32Z Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282645#M2359 <P>Trying to figure out why the Splunk Enterprise Security App has a savedsearch and a correlation search for brute force seems redundant but probably missing a key distinction. Can someone give me some guidance?</P> Wed, 08 Feb 2017 19:34:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282645#M2359 jgbricker 2017-02-08T19:34:42Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282646#M2360 <P>savedsearch is the search knowledge object for the notable. the correlationsearch.conf stanza goes with that and ES needs it for all the notable like settings. hooks to active responses, title, links for drill down etc.</P> Wed, 08 Feb 2017 19:42:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282646#M2360 starcher 2017-02-08T19:42:32Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282647#M2361 <P>Okay so to clarify further, I would need both if I were adding my own detections into the ES framework? I didn't see that in the documentation.</P> Wed, 08 Feb 2017 19:46:02 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282647#M2361 jgbricker 2017-02-08T19:46:02Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282648#M2362 <P>Yes, you would need stanzas in both if you were to add your own correlation searches. However, I'd recommend that you use the content management page to create the searches so that the proper attributes are saved in the proper locations. Starting in 4.6.0, only savedsearches.conf references are needed. </P> Wed, 08 Feb 2017 20:04:05 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282648#M2362 smoir_splunk 2017-02-08T20:04:05Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282649#M2363 <P>Yes and the GUI based create process handles all that for you.<BR /> <A href="http://docs.splunk.com/Documentation/ES/4.6.0/Tutorials/CorrelationSearch">http://docs.splunk.com/Documentation/ES/4.6.0/Tutorials/CorrelationSearch</A> </P> Wed, 08 Feb 2017 20:05:46 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282649#M2363 starcher 2017-02-08T20:05:46Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282650#M2364 <P>Okay, it does appear that when i add a correlation search via the UI (Content Management &gt; Create Content) a savedsearch is created automatically. Doesn't this mean Splunk has to search for the same thing twice to do all the things it needs to do for ES. Perhaps I'm still confused here.</P> Wed, 08 Feb 2017 20:07:09 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282650#M2364 jgbricker 2017-02-08T20:07:09Z Re: Splunk Enterprise Security: What is the distinction between savedsearch and correlation search? https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282651#M2365 <P>No, the search isn't performed twice, it's just a detail about how the search is stored.</P> Wed, 08 Feb 2017 20:42:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-Enterprise-Security-What-is-the-distinction-between/m-p/282651#M2365 smoir_splunk 2017-02-08T20:42:24Z