https://community.splunk.com/t5/Splunk-Enterprise-Security/Difference-between-correlation-search-written-with-data-modals/m-p/486065#M8002 <P>Hi Team,</P> <P>What is the difference between correlation search created with the datamodals and the correlation search created with normal search query.</P> <P>Which is good to follow?</P> Sun, 12 Jan 2020 05:57:39 GMT VijaySrrie 2020-01-12T05:57:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Difference-between-correlation-search-written-with-data-modals/m-p/486065#M8002 <P>Hi Team,</P> <P>What is the difference between correlation search created with the datamodals and the correlation search created with normal search query.</P> <P>Which is good to follow?</P> Sun, 12 Jan 2020 05:57:39 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Difference-between-correlation-search-written-with-data-modals/m-p/486065#M8002 VijaySrrie 2020-01-12T05:57:39Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Difference-between-correlation-search-written-with-data-modals/m-p/486066#M8003 <P>Both are correlation searches that will ultimately produce notable events. What they search is completely up to you. Using a data model typically means the data you think the notable event occurs in, has been normalized to the model. Using regular indexed data can be slower on performance, but not necessarily. Imagine querying a very large data model versus a very small index, or even a small lookup table. One will be faster but both could be "enriched/normalized" with different fields.</P> Sun, 12 Jan 2020 12:17:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Difference-between-correlation-search-written-with-data-modals/m-p/486066#M8003 jkat54 2020-01-12T12:17:40Z