I am trying to create a notable event I am writing a query (index=****** EventCode=4771) in search App and then clicking on SaveAs and then click on Alert. Then a popup opens for alert configuration. In that i have trigger Actions where there is option of Notable( Creates notable events). This creates a notable event . Is this the correct way of creating?
I see notables events created in Enterprise Security, however there is lot of events triggered (close to 1000 events) Each single events are generated, but not the aggregated one. Is there a way i can aggregate that in ES? .
Pls go through this and create correlation searches and add throttling to limit the number of alerts you see. Also, a good practice would be to use index= yourspecificindex addition to your search above
I dont see that option of create correlation search under the configure->Content_>Content Mangagmeent->Create New content. I dont have admin access, its power user.
Let me tell how i created a notable event first. From the Search&Reporting app, wrote a query , then clicked on save as->Alert->filled in all the conditions->under trigger actions selected notable(creates notable events)
What is happening now is that configured alert is firing individual notable events and not aggregated one(like 10 failed logins in 1 min, then fire 1 notable event, that is not the case, all the 10 failed events are firing).
I had already given aggregation when i created that alert. Is there any way i can put an aggregation on notable event itself.
I assume you are using Splunk Enterprise Security (premium product). If so, you would need to navigate to 'Enterprise Security' App and then you can navigate to Configure->Content Mgmt etc...
When working in Splunk ES, normally, we don't use 'Search and reporting' app, as the context is different.
If you are not having Splunk ES, what you are trying to do is the normal alert. Pls check again and share the splunk version and Splunk ES version. Also, go through above link.