Splunk Enterprise Security

Creating a notable event from correlation search

shiftey
Path Finder

Hi
Im using the below search and wish to create a notable event from the search. (filtered to not show company info)

sourcetype=DhcpSrvLog description=assign dest!=prefix1* prefix2* dest_ip!=x.x.x.x/20 dest_ip!=x.x.x.x/21 | rex mode=sed field=dest "s/.companydomain.com//g" | where dest!=dest_mac | table dest,dest_ip,dest_mac,time,date | sort date

When I search manually over last 24 hours I get results, however no notable events are created. Does the correlation search syntax need to be in a certain format to generate the notable event?

1 Solution

LukeMurphey
Champion

The correlation search does need to be in a particular format (needs to make an event in the notable index and have particular fields). I suggest using the Correlation Search Editor to make it (Configuration » Custom Searches) since it will handle the particulars for you. Make sure to enable the "Create notable event" action so that the search creates a notable event for you.

View solution in original post

kamal_jagga
Contributor

Hi Luke,

I am also trying to create some custom correlation searches and notables from my daily reports.

Steps I followed to make this:
1. In ES ==> ES ==> Configure ==> Content Mgmt ==> Create New Content ==> Correlation Searches
2. While creating the correlation searches, I added the name of the new notable (assuming that this would create new notable) and scheduled and saved it.

The query runs fine and gives the output in tabular format. Its creating the notables but I am not able to see the contributing events/error event.

As you mentioned above, could you advise on the format needed to make an event in the notable index and have particular fields.

Also, I am unable to find Correlation Search Editor to make it (Configuration » Custom Searches)

Kindly advise.

0 Karma

kamal_jagga
Contributor

I created the notable events in the Configure==> Incident events as well. Still unable to see the contributing events in incidents.

kamal_jagga
Contributor

I hadn't named the Drill-down search while creating the notable. Once it was updated, the contributing events started showing up as expected.

0 Karma

LukeMurphey
Champion

The correlation search does need to be in a particular format (needs to make an event in the notable index and have particular fields). I suggest using the Correlation Search Editor to make it (Configuration » Custom Searches) since it will handle the particulars for you. Make sure to enable the "Create notable event" action so that the search creates a notable event for you.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...