Splunk Enterprise Security

How do you create a correlation search in Splunk Enterprise from a simple search of an index?

jdobbins_2
New Member

I have a simple search alert such as (index=A src_user=userA) which uses lookup tables to filter data. I'd like these alerts to create notable events of a specific type, and automatically get assigned to someone. It appears as though the only way to customize notable event information like this is with a correlation search.

Is there a way to use a simple search, such as above, as a correlation search to be able to utilize the advanced settings for a notable event? I have created a version of this search with a data model to use it as a correlation search, but it is extremely slow compared to the simple search equivalent.

Thanks

0 Karma

kamal_jagga
Contributor

Ideally the process is

Steps:
1. In ES ==> ES ==> Configure ==> Content Mgmt ==> Create New Content ==> Correlation Searches ==> New Correlation search.
2. Add your code in the search sections and fill up the rest of the fields.
3. Add notable action and save it.

0 Karma
Get Updates on the Splunk Community!

Join the Splunk Developer Program Hackathon: Splunk Build-a-thon!

The Splunk Developer Program is launching in beta, and we’re celebrating with an exciting hackathon! This is ...

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...