Splunk Enterprise Security

Enabled Correlation Search not running?

indmin
Loves-to-Learn Lots

I have enabled several correlation searches in ES. Those search run normally and return result as expected if I search them manually

However, those searches are not running as schedule and never show up if I search using "index=_internal sourcetype=scheduler". Also, their statistics in "Content Management" page suggest that they have been never triggered.

Do you have any suggestion on this issue??? 

Screenshot 2022-11-15 173903.png

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...