How we can troubleshoot the ES Correlation Search for "non pdm alerts"?


I have a significant number of Notables raised by the Non-pdm alerts correlation search.

The correlation search runs every 2 hours, triggers an alert when the user violates the policy
sourcetype=netskope earliest=-2h NOT (alert_name IN ("pdm", " External_Shared Files - Alert", "All DLP Policies"))
| stats dc(alert_name) as alert_count,values(_time) as incident_time by user
Throttling is set to 3 days duration what changes we need to make a less no. of notables to be raise?

Labels (2)
0 Karma


You have a few options.

1) Train the users to not violate policy

2) Adjust policy to better reflect what users need to do

3) Modify the CS to filter out "uninteresting" events

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...