Splunk Enterprise Security

How to fetch configured correlation data, query notable events, including associated correlation rules for an app?

sacumen
Explorer

How to fetch configured correlation data, Query notable events, including associated correlation rules for an app?

0 Karma

rajashekar_s
Path Finder

@sacumen see if the following rest query gives what you are looking for

 

| rest /servicesNS/-/-/saved/searches
| search title=*
| table title cron_schedule eai:acl.owner actions dispatch.earliest_time dispatch.latest_time search

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Query notable events with index=notable.
Correlations rules are stored in the app's savedsearches.conf files.
What other correlation data do you seek?

---
If this reply helps you, an upvote would be appreciated.

indut
Path Finder

Thank you, I had the same query and this answer helped 🙂

0 Karma

sacumen
Explorer

Thanks for responding, but I am trying to fetch all the available correlation data through rest call, is there any api to achieve this in splunk?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Again I ask what correlation data to you seek?
See the REST API manuals for how to get data from Splunk using REST. https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTUM/RESTusing
https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTREF/RESTprolog

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on