Splunk Enterprise Security
Highlighted

Splunk Enterprise Security: Why are correlation searches not saving in search head cluster?

Explorer

I am using search head cluster and trying to create a correlation search by selecting application context as "DA-ESS-AccessProtection",
but it is not getting saved as correlation search, it's being saved as saved search.
if I select application context as "SA-*" (ie, SA-AccessProtection) then it works. I am trying to troubleshoot but no luck.
we use the below version
Spunk Enterprise version = 6.4.0
Splunk Enterprise Security= 4.0.1

0 Karma
Highlighted

Re: Splunk Enterprise Security: Why are correlation searches not saving in search head cluster?

Explorer
0 Karma