Splunk Enterprise Security

How to fetch configured correlation data, query notable events, including associated correlation rules for an app?

sacumen
Explorer

How to fetch configured correlation data, Query notable events, including associated correlation rules for an app?

0 Karma

rajashekar_s
Path Finder

@sacumen see if the following rest query gives what you are looking for

 

| rest /servicesNS/-/-/saved/searches
| search title=*
| table title cron_schedule eai:acl.owner actions dispatch.earliest_time dispatch.latest_time search

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Query notable events with index=notable.
Correlations rules are stored in the app's savedsearches.conf files.
What other correlation data do you seek?

---
If this reply helps you, Karma would be appreciated.

indut
Path Finder

Thank you, I had the same query and this answer helped 🙂

0 Karma

sacumen
Explorer

Thanks for responding, but I am trying to fetch all the available correlation data through rest call, is there any api to achieve this in splunk?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Again I ask what correlation data to you seek?
See the REST API manuals for how to get data from Splunk using REST. https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTUM/RESTusing
https://docs.splunk.com/Documentation/Splunk/8.0.2/RESTREF/RESTprolog

---
If this reply helps you, Karma would be appreciated.
0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...