Splunk Enterprise Security

Incident Review Dashboard - Correlation Search List is not working on Enterprise Security 5.0.1

cvitrano
Engager

Hi All!

I did an upgrade on Enterprise Security from 4.7.4 to 5.0.1. I'm using Splunk Enterprise Instances 7.0.3.

I have a problem with the Incident Review dashboard, the "Correlation Search Name" is always empty, disabled and presents the following error "Search produced no results".

Another related issue: If I click on the name of one Correlation Search under "Top Notable Events" table in Security Posture Dashboard, the forms on the Incident Review Dashboard are not filled out.

Could anyone help me on this topic?

0 Karma
1 Solution

cvitrano
Engager

I was able to resolve it. The "Threat - Correlation Searches - Lookup Gen" should be enabled to make it work.

View solution in original post

cvitrano
Engager

I was able to resolve it. The "Threat - Correlation Searches - Lookup Gen" should be enabled to make it work.

Get Updates on the Splunk Community!

Combine Multiline Logs into a Single Event with SOCK - a Guide for Advanced Users

This article is the continuation of the “Combine multiline logs into a single event with SOCK - a step-by-step ...

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...