Reporting

correlation search was not found

vin02
Path Finder

we are using enterprise security 4.7.x. we have created custom app and added saved search in that to trigger the incident review.its creating the incident in the incident review page but while i am clicking the link correlation search, its redirecting to pop-up like correlation search was not found.

could you please help on this.

0 Karma
1 Solution

jstoner_splunk
Splunk Employee
Splunk Employee

There are a number of switches/options available within the savedsearches.conf for correlation searches that were previously in the correlationsearches.conf file. If you look at your savedsearches.conf file in DA-ESS-EndpointProtection/default/ (for example) you will see saved searches that are used for reports v correlation searches and the different options that correlation searches use including a number of action.notable and action.risk options, cron_schedule amongst others.

My suggestion would be to use these correlation searches as a template so that when you click on it, it will populate appropriately. Alternatively, you could use the Configure->Content Management and click Create New Content->Correlation Search, specify your app and create the conditions and notable from there.

View solution in original post

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

There are a number of switches/options available within the savedsearches.conf for correlation searches that were previously in the correlationsearches.conf file. If you look at your savedsearches.conf file in DA-ESS-EndpointProtection/default/ (for example) you will see saved searches that are used for reports v correlation searches and the different options that correlation searches use including a number of action.notable and action.risk options, cron_schedule amongst others.

My suggestion would be to use these correlation searches as a template so that when you click on it, it will populate appropriately. Alternatively, you could use the Configure->Content Management and click Create New Content->Correlation Search, specify your app and create the conditions and notable from there.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...