Alerting

Is there a good source of document for Splunk event correlation? or any suggestions?

clyde772
Communicator

Anybody out there had experience trying to correlate events with Splunk.

A scenario would be like this:

(Source : A Event XXX) + (Source : B Event YYY) = ( Result : kick off an event using a scipt )

Is correlation supported with Splunk?

Tags (1)
0 Karma

piebob
Splunk Employee
Splunk Employee

BunnyHop
Contributor

This is something I am trying to accomplish altogether by creating my own app with saved searches. This helps seggregate the correlated data I want/need while making it easily accessible for all other parties. The app piece is purely optional, but when you do a saved search, you can kick off a script or an alert, base on your own choosing.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

This is exactly what Splunk searches and alerts do, though I would have to assume there are also implicit time bounds on your correlation.

Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...