https://community.splunk.com/t5/Splunk-Enterprise-Security/Setting-Multiple-severity-level-for-same-Correlation-search/m-p/326750#M3033 <P>Within the correlation search you may be able to use an <CODE>eval</CODE> command with something like a <CODE>case</CODE> statement to do this. However, if you have a list of IPs, I am hoping that there is a second column that has a descriptor like high severity ip and low severity ip. That way the case statement could look for one of the other and assign an urgency based on that value. I have not tested that, but something along those lines should work. </P> <P>This example we forced an urgency in for reference: <A href="https://answers.splunk.com/answers/495073/splunk-enterprise-security-is-there-a-way-to-force.html#answer-495107">https://answers.splunk.com/answers/495073/splunk-enterprise-security-is-there-a-way-to-force.html#answer-495107</A></P> Fri, 08 Sep 2017 12:14:38 GMT jstoner_splunk 2017-09-08T12:14:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Setting-Multiple-severity-level-for-same-Correlation-search/m-p/326749#M3032 <P>Hi,</P> <P>Is it possible to set two different severity level for same Correlation search.</P> <P>For Eg <BR /> My search output list source that are communicating to blacklisted IPs<BR /> I have set the severity level as high in notable event of the search. But i want to include one more severity level as "informational" for few IPs.</P> <P>Thanks</P> Fri, 08 Sep 2017 12:05:12 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Setting-Multiple-severity-level-for-same-Correlation-search/m-p/326749#M3032 Shradha_Venkata 2017-09-08T12:05:12Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Setting-Multiple-severity-level-for-same-Correlation-search/m-p/326750#M3033 <P>Within the correlation search you may be able to use an <CODE>eval</CODE> command with something like a <CODE>case</CODE> statement to do this. However, if you have a list of IPs, I am hoping that there is a second column that has a descriptor like high severity ip and low severity ip. That way the case statement could look for one of the other and assign an urgency based on that value. I have not tested that, but something along those lines should work. </P> <P>This example we forced an urgency in for reference: <A href="https://answers.splunk.com/answers/495073/splunk-enterprise-security-is-there-a-way-to-force.html#answer-495107">https://answers.splunk.com/answers/495073/splunk-enterprise-security-is-there-a-way-to-force.html#answer-495107</A></P> Fri, 08 Sep 2017 12:14:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Setting-Multiple-severity-level-for-same-Correlation-search/m-p/326750#M3033 jstoner_splunk 2017-09-08T12:14:38Z