<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Reg. Correlation searches. Do they have to be configured in Splunk Ent. &amp;amp; ES? Could they be only on one of these in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545475#M154512</link>
    <description>&lt;P&gt;Correlation searches are an ES concept.&amp;nbsp; Outside of ES they're called "scheduled searches".&amp;nbsp; Whatever they're called and wherever they exist they still have access to all of your indexed data.&lt;/P&gt;&lt;P&gt;What are you doing with them that they need to be in both the ES search head and the non-ES search head?&amp;nbsp; IMO, running the same search in two search heads just doubles the load on the indexers.&lt;/P&gt;</description>
    <pubDate>Thu, 25 Mar 2021 19:39:33 GMT</pubDate>
    <dc:creator>richgalloway</dc:creator>
    <dc:date>2021-03-25T19:39:33Z</dc:date>
    <item>
      <title>Reg. Correlation searches. Do they have to be configured in Splunk Ent. &amp; ES? Could they be only on one of these 2 ?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545458#M154504</link>
      <description>&lt;P&gt;Reg. Correlation searches. Do they have to be configured in Splunk Ent. &amp;amp; ES? Could they be only on one of these 2 ? And reused in the whole environment? If can be on one side? How do I benefit across the whole environment?&lt;/P&gt;</description>
      <pubDate>Thu, 25 Mar 2021 18:04:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545458#M154504</guid>
      <dc:creator>SamHTexas</dc:creator>
      <dc:date>2021-03-25T18:04:46Z</dc:date>
    </item>
    <item>
      <title>Re: Reg. Correlation searches. Do they have to be configured in Splunk Ent. &amp; ES? Could they be only on one of these</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545475#M154512</link>
      <description>&lt;P&gt;Correlation searches are an ES concept.&amp;nbsp; Outside of ES they're called "scheduled searches".&amp;nbsp; Whatever they're called and wherever they exist they still have access to all of your indexed data.&lt;/P&gt;&lt;P&gt;What are you doing with them that they need to be in both the ES search head and the non-ES search head?&amp;nbsp; IMO, running the same search in two search heads just doubles the load on the indexers.&lt;/P&gt;</description>
      <pubDate>Thu, 25 Mar 2021 19:39:33 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545475#M154512</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2021-03-25T19:39:33Z</dc:date>
    </item>
    <item>
      <title>Re: Reg. Correlation searches. Do they have to be configured in Splunk Ent. &amp; ES? Could they be only on one of these</title>
      <link>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545477#M154513</link>
      <description>&lt;P&gt;That answers my question sir, Thank u.&lt;/P&gt;</description>
      <pubDate>Thu, 25 Mar 2021 19:53:43 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/Reg-Correlation-searches-Do-they-have-to-be-configured-in-Splunk/m-p/545477#M154513</guid>
      <dc:creator>SamHTexas</dc:creator>
      <dc:date>2021-03-25T19:53:43Z</dc:date>
    </item>
  </channel>
</rss>

