Splunk Enterprise Security

Correlation search not showing notable in Incident Review?

Path Finder

Hi Splunkers.

I have noticed a strange behavior from Splunk, I have a correlation search that I have created a while ago, ensured to select "Notable" under the Adaptive Responsive section so that it creates a notable, also tested that when I run the search manually it produced results. BUT it does not generate notables in the Incident Review dashboard!

So I went and searched index=notable and found 4 events for this correlation search in the last 30 days!
Then I checked the same index for another correlation search that DOES generate notables in the Incident Review dashboard (4 notables in the last 30 days) and indeed I found 4 events in the notable index!

I also used the "Correlation Search Audit" app (https://splunkbase.splunk.com/app/4144) and Indeed this app shows that this correlation search has been triggered 4 times in the last 30 days! 

The search does not have any lookups (In case you asked about the permissions of the lookups).
The search does use the Web data model (and it has Global permissions).

I'm using the admin user so I have sufficient privileges.

I'm using:
Splunk Enterprise version: 8.1.0
Enterprise Security version: 6.2.0
OS: Red Hat Enterprise Linux Server 7.7 (Maipo)

Any Idea why this is happening? 

Labels (3)
0 Karma


What you are describing happens when the correlation rule is suppressed.  Did you check the suppression page for this alert ? 
Secondly when you ran the search manually , did it produce results in a tabular format ?  Typically correlation search results are in a tabular format.

P.S Pls upvote if this helps.

0 Karma

Path Finder

I have checked but nope, it's not suppressed.
And yes the search produces results in a tabular format

0 Karma


Perhaps the NE is being suppressed.  Check by going to Configure->Incident Management->Notable Event Suppressions

If this reply helps you, Karma would be appreciated.
0 Karma

Path Finder

I have checked but nope, it's not suppressed

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...