correlation search was not found

[vin02]

we are using enterprise security 4.7.x. we have created custom app and added saved search in that to trigger the incident review.its creating the incident in the incident review page but while i am clicking the link correlation search, its redirecting to pop-up like correlation search was not found.

could you please help on this.

[jstoner_splunk · Accepted solution]

There are a number of switches/options available within the savedsearches.conf for correlation searches that were previously in the correlationsearches.conf file. If you look at your savedsearches.conf file in DA-ESS-EndpointProtection/default/ (for example) you will see saved searches that are used for reports v correlation searches and the different options that correlation searches use including a number of action.notable and action.risk options, cron_schedule amongst others.

My suggestion would be to use these correlation searches as a template so that when you click on it, it will populate appropriately. Alternatively, you could use the Configure->Content Management and click Create New Content->Correlation Search, specify your app and create the conditions and notable from there.