Is there a good source of document for Splunk event correlation? or any suggestions?


Anybody out there had experience trying to correlate events with Splunk.

A scenario would be like this:

(Source : A Event XXX) + (Source : B Event YYY) = ( Result : kick off an event using a scipt )

Is correlation supported with Splunk?

Tags (1)
0 Karma



This is something I am trying to accomplish altogether by creating my own app with saved searches. This helps seggregate the correlated data I want/need while making it easily accessible for all other parties. The app piece is purely optional, but when you do a saved search, you can kick off a script or an alert, base on your own choosing.

0 Karma

Splunk Employee
Splunk Employee

This is exactly what Splunk searches and alerts do, though I would have to assume there are also implicit time bounds on your correlation.

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...