How do correlation searches work with other source types if the source types weren't specified in search?

[tokio13]

Hello everyone,

I have the following question:

For use cases (anything in the Enterprise Security > content), let's say I have 5 sourcetypes.  If I create a new correlation search that I want to work for these 5 sourcetypes that I have the following:

index=something sourcetype=something1 OR sourcetype=something2 OR sourcetype=something3 OR sourcetype=something4 OR sourcetype=something5

That would mean that whenever a new source type is onboarded I would have to manually add it to all the correlation searches that I created or that are by default in Splunk Enterprise Security content.

How do other correlation searches work (the ones that come by default with ES) with other source types if the source types weren't specified in the query?

[tokio13]

This was very insightful! Thank you both
Things have much more sense now

[gcusello]

Hi @tokio13,

in your correlation search you could use an eventtype containing your five sourcetypes, so when you'll need to add a new sourcetype, you'll have only to update the eventtype.

In addition, it's easier using the IN operator:

index=something sourcetype IN (something1, something2, something3, something4,  something5)

Ciao.

Giuseppe

[richgalloway · Accepted solution]

This is why we have macros and eventtypes/tags.  You could create a macro with the list of sourcetypes and use that macro in your CSs.  Any change to the list of sourcetypes means a single change to the macro and all CSs are up-to-date.

Similarly, you could create an eventtype that uses the sourcetypes and put eventtype=foo in your CSs.