https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437873#M5817 <P>You can directly use your search and convert to co-relation search. The below will create a notable only when Total MB is greater than 100. You can change as per your need. You can create using guided mode or directly add the search in the cor.search [ <A href="https://docs.splunk.com/Documentation/ES/5.3.0/Tutorials/GuidedCorrelationSearch">https://docs.splunk.com/Documentation/ES/5.3.0/Tutorials/GuidedCorrelationSearch</A>]. You can then setup throttling to not alert for same host or port etc. for next 1 day or so.</P> <PRE><CODE>index=stream_netflow sourcetype="stream:netflow" dest_port=69 OR dest_port=20 OR dest_port=21 | eval totalbytes=(bytes_out) | eval total_mb=(totalbytes/1024/1024) | eval total_mb=round(total_mb,2) | stats sum(total_mb) as "Total MB", count(_raw) as "Event Count" by src_ip, src_port, dest_ip, dest_port | where "Total MB" &gt; 100 </CODE></PRE> Fri, 03 May 2019 15:39:13 GMT lakshman239 2019-05-03T15:39:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437872#M5816 <P>I'll start with the goal of what I am trying to accomplish first. I'd like to be able to detect any source sending data out in the middle of the night (example 11 PM to 6 AM) by means of FTP ( Ports 20,21,69) with a specific amount of data ( x mbs or y bytes ) using our Stream data. I'm not really sure how to build a correlation search to accomplish that but in that, I have a search I've built for a dashboard to attempt to track this which I'll copy below but more so looking to be able to use Enterprise Security to accomplish it. </P> <P>index=stream_netflow sourcetype="stream:netflow" dest_port=69 OR dest_port=20 OR dest_port=21<BR /> | eval totalbytes=(bytes_out)<BR /> | eval total_mb=(totalbytes/1024/1024)<BR /> | eval total_mb=round(total_mb,2)<BR /> | stats sum(total_mb) as "Total MB", count(_raw) as "Event Count" by src_ip, src_port, dest_ip, dest_port <BR /> | sort -"Total MB" limit=15</P> <P>Any help or ideas would be greatly appreciated! </P> Wed, 30 Sep 2020 00:20:19 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437872#M5816 Crashfry 2020-09-30T00:20:19Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437873#M5817 <P>You can directly use your search and convert to co-relation search. The below will create a notable only when Total MB is greater than 100. You can change as per your need. You can create using guided mode or directly add the search in the cor.search [ <A href="https://docs.splunk.com/Documentation/ES/5.3.0/Tutorials/GuidedCorrelationSearch">https://docs.splunk.com/Documentation/ES/5.3.0/Tutorials/GuidedCorrelationSearch</A>]. You can then setup throttling to not alert for same host or port etc. for next 1 day or so.</P> <PRE><CODE>index=stream_netflow sourcetype="stream:netflow" dest_port=69 OR dest_port=20 OR dest_port=21 | eval totalbytes=(bytes_out) | eval total_mb=(totalbytes/1024/1024) | eval total_mb=round(total_mb,2) | stats sum(total_mb) as "Total MB", count(_raw) as "Event Count" by src_ip, src_port, dest_ip, dest_port | where "Total MB" &gt; 100 </CODE></PRE> Fri, 03 May 2019 15:39:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437873#M5817 lakshman239 2019-05-03T15:39:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437874#M5818 <P>Just had to rearrange the search to make it work - the where clause had to be above the stats clause. Now it works - thanks for the help. </P> Mon, 06 May 2019 16:48:23 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Correlation-search-Stream-events/m-p/437874#M5818 Crashfry 2019-05-06T16:48:23Z