Splunk Enterprise Security

Enabled Correlation Search not running?

indmin
Loves-to-Learn Lots

I have enabled several correlation searches in ES. Those search run normally and return result as expected if I search them manually

However, those searches are not running as schedule and never show up if I search using "index=_internal sourcetype=scheduler". Also, their statistics in "Content Management" page suggest that they have been never triggered.

Do you have any suggestion on this issue??? 

Screenshot 2022-11-15 173903.png

0 Karma
Get Updates on the Splunk Community!

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...

Explore the Latest Educational Offerings from Splunk (November Releases)

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...