Alert setup

Splunk Enterprise Security

Hi All,

I have a correlation search created where an alert unique ID is generated.

That alert id is then used in Episode review which inturn will be used to raise incident.

Somehow the alert ID is not getting ingested in Episode review.

Recently the index name for correlation was changed, will that affect anything ?

Please help

Thanks & Regards

Sumeet Firodia

Get Updates on the Splunk Community!

We’ve all been there, right? Living our best life, working on our Splunk environment, when out of nowhere a ...

Set Up Data Where You Use It Catalog already helps teams find and understand data across Splunk indexes, ...

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Join the Conversation