Monitoring Splunk

Co-relation search

friend444
Explorer

I have two co-relation search in ITSI which is scheduled to 15 minutes of windows, what is the appropriate scheduled should be set to avoid any performance issue in future.

Labels (1)
0 Karma

yannK
Splunk Employee
Splunk Employee

There are no definitive answers, it depends on your search time, the server concurrency load, and the desired time to be notified of alerts or the frequency.

Example : you run 2 correlation searches running every 15 minutes, looking back at 15 minutes.

  • If the searchest take 10 seconds to execute, then it will not count on your search concurrency as 2 jobs for 10 seconds every 15 min.
  • If the searches take 20 minutes to run, then it will persistently count at 2 job concurrencies, plus every 15 min, you will have an overlap, and it will count at 4...

If you have an alert condition happening t=0, then the correlation search runs as t=10m, then it will take you 10 minutes to be get a notable alert created, and a few seconds to get grouped in an Episode and trigger an action.
Changing the frequency will help control the time before you are notified, it may vary based on the type of data you are monitoring,

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...