Splunk Enterprise Security

How do you create a correlation search in Splunk Enterprise from a simple search of an index?

jdobbins_2
New Member

I have a simple search alert such as (index=A src_user=userA) which uses lookup tables to filter data. I'd like these alerts to create notable events of a specific type, and automatically get assigned to someone. It appears as though the only way to customize notable event information like this is with a correlation search.

Is there a way to use a simple search, such as above, as a correlation search to be able to utilize the advanced settings for a notable event? I have created a version of this search with a data model to use it as a correlation search, but it is extremely slow compared to the simple search equivalent.

Thanks

0 Karma

kamal_jagga
Contributor

Ideally the process is

Steps:
1. In ES ==> ES ==> Configure ==> Content Mgmt ==> Create New Content ==> Correlation Searches ==> New Correlation search.
2. Add your code in the search sections and fill up the rest of the fields.
3. Add notable action and save it.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...