How can I set up notable events and correlation searches in Splunk ES?

[yeasuh]

How can I set up notable events and correlation searches in Splunk ES?

[ejahnke]

Hey yeasuh,

head over to https://docs.splunk.com/Documentation/ES/7.1.1/Tutorials/CorrelationSearch

Assuming you already got an idea for a CS you Skip to Part 2 and follow the instructions there. You could also use the guided mode, if youre not that comfortable with using SPL.

For the notable part: Go to Step 5 and chose the adaptive response action "Notable ". The docs are pretty thorough and should anwers all your questions. If you got any more questions after going thru the docs just hit me up. Cheers!