Alerting

Correlation Search not creating a notable event, but is triggering email alerts.

dlevesque1
New Member

Hello,

I am trying to create a notable event in the mission control area within Enterprise Security to capture when an index has not received data within 24 hours. This should be simple and straight forward but I can't seem to figure out why this isn't working. 

I have the detection search as 
index = <target index>
|stats count

condition in the alert to trigger is
search count = 0

I also have email alerts setup as an additional way to notify the proper people,  this part of the security content works, but why doesn't the actual event appear in the Mission control area? This has me stumped, any help would be greatly appreciated.

Labels (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @dlevesque1 

Have you created this through the "Content Management" section within ES or is this a correlation search that you have created with the notable alert action? Ensure that you are creating from within the Content Management section if not already.

Which version of ES are you using?

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma

PickleRick
SplunkTrust
SplunkTrust

If I remember correctly, the alert created "normally" with a "create notable" action should work as well (although it will have less configuration options). But in order to be able to create notables the user who the alert is run with must have proper privileges within the ES app. So if an alert was created with a normal alert creation means instead of ES Content Management, the user might not be able to create notable due to insufficient permissions. (yes, I'm aware that it sounds a bit convoluted).

0 Karma
Get Updates on the Splunk Community!

Index This | What’s a riddle wrapped in an enigma?

September 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

BORE at .conf25

Boss Of Regular Expression (BORE) was an interactive session run again this year at .conf25 by the brilliant ...

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...