Alert setup

Splunk Enterprise Security

Hi All,

I have a correlation search created where an alert unique ID is generated.

That alert id is then used in Episode review which inturn will be used to raise incident.

Somehow the alert ID is not getting ingested in Episode review.

Recently the index name for correlation was changed, will that affect anything ?

Please help

Thanks & Regards

Sumeet Firodia

Get Updates on the Splunk Community!

If you stopped by the Builder Bar at .conf26, thank you! This year, we brought ...

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Join the Conversation