Splunk Enterprise Security

Splunk correlation search with throttling generating duplicates on an ES clustered environment

mjones414
Contributor

We recently moved from a stand-alone ES splunk search head to a clustered splunk ES search head, and we've started to see doubling, and in some cases tripling up of some of our correlation search results where we've configured throttling that we have not seen on the stand-alone machine. 

Scenario:

correlation search scheduled to run 23 minutes after the hour every 6 hours. search looks back 24 hours to now().   Throttling is set to 1 day. 

Search runs, generates notable events.  12 hours later, search generates notable for the same events it found in the first run, implying that the search likely ran once on the same search head, and on a different search head the second time.

 

Is there a way to confirm that all search heads have the same criteria for what should be throttled and for how long?  

 

DanielSp
Explorer

Did you found the issue? Alerts with throttle works correctly in distributed environment?

0 Karma

mjones414
Contributor

It took a case opened with Splunk Enterprise support, but ultimately there was a setting set on the SH cluster that solved this issue.  As I'm no longer in a splunk admin-esque role, I can't tell you exactly what was changed, but there was certainly something that was changed in how SH cluster peers reconciled correlation searches where throttling was used.

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...