Greetings Splunkers,
I have recently started having triggered alerts from a couple of correlation searches that when attempting to fix or troubleshoot the specific rule, the query would actually fail for errors relating to the query itself (example: unescaped slashes, lookups that do not exist etc.)
How do those Notables even trigger if the query itself fails? How do I audit changes done to a correlation search to make sure no changes were done to the rule?
Thanks,
Regards,
