Splunk Enterprise Security

Splunk Correlation Search use Adaptive Response Actions 5mins stop

wlight600
Engager

when I create a Correlation Search ,this Correlation Search will trige Adaptive Response Actions. But search result is very large,so action will run for a long time. But when action run after 5min,this action stop. I don't know why action stop but search result didn't process completely. How to make the 5min disappear.

Labels (2)
0 Karma

lakshman239
SplunkTrust
SplunkTrust

Rather than trying to increase Adaptive Response (AR) timeout, I would try to simplify your correlation search and the other searches required to feed inputs to AR, so they complete quickly. E.g you may pre-process known data/searches, to be used in correlation and/or AR invocations.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...