Splunk Enterprise Security

Splunk Correlation Search use Adaptive Response Actions 5mins stop

wlight600
Engager

when I create a Correlation Search ,this Correlation Search will trige Adaptive Response Actions. But search result is very large,so action will run for a long time. But when action run after 5min,this action stop. I don't know why action stop but search result didn't process completely. How to make the 5min disappear.

Labels (2)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

Rather than trying to increase Adaptive Response (AR) timeout, I would try to simplify your correlation search and the other searches required to feed inputs to AR, so they complete quickly. E.g you may pre-process known data/searches, to be used in correlation and/or AR invocations.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...