topic Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear in Splunk Search

how to label the attributing events additional fields which can associate the correlation search and drill-down search?

jaro — Fri, 05 Jan 2024 02:40:06 GMT

Here are the screenshots:

In incident review setting, I have already labeled signature:

Then in Correlation Search content setting, also I have setting the search query which could result in fields with signature. This search can be run normally in search head and show the result I want.

But here related to drill-down search or description, this $signature$ can not show in notable of incident review:

May I ask how to solve this issue?

Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear

gcusello — Fri, 05 Jan 2024 07:53:08 GMT

Hi @jaro,

to see a field in the fields of a Notable (in the Incident Review dashboard) you have to check if this field is displayed in the Notable event (running index=notable search=your_correlation_search),

if not, probably isn't displayed in the output of the correlation search: manually run your correlation search and see if the field is displayed, if not add it to the correlation Search.

One additional hint: don't modify the Correlation Search, but clone it and modify and enable only the cloned one.

If the field is present in the Notable event, you have also to check if it's present in the default visible fields, that you can find these configurations at [Configure > Incident management > Incident Review Settings] in the section Incident Review - Event Attributes.

Ciao.

Giuseppe

Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear

jaro — Fri, 05 Jan 2024 09:50:17 GMT

Thanks @gcusello. ---to check if this field is displayed in the Notable event (running index=notable search=your_correlation_search), yes, I have display the result "signature" in the search I ran. However, the below description can not show the field value "signature" I search in correlation search as $signature$.

Also I have tried eval other name equal to field signature, still nothing.

Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear

gcusello — Fri, 05 Jan 2024 10:11:44 GMT

Hi @jaro ,

if the field is in the Notable index, can be displayed.

Did you checked if it's in the visualized fields?

Ciao.

Giuseppe

Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear

jaro — Mon, 08 Jan 2024 03:39:02 GMT

It's OKAY now. In next triggered notable, it displayed. Thank you @gcusello.

Re: how to label the attributing events additional fields which can associate the correlation search and drill-down sear

gcusello — Mon, 08 Jan 2024 07:18:04 GMT

Hi @jaro ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉