Splunk Enterprise Security

The Notable Generation doesn't produce the expected results?

davidem
Engager

Hi,

I created a new Correlation Search that needs to generate notable, so in the "Adaptive Response Actions" I added the "Notable" with all information.

Doing a manual search with the same time span as the correlation search, I've got the expected outputs. The problem is that the correlation search doesn't create the same number of notables.

For example: in a range time of 4 hours, the correlation search has generated 4 notables, instead, doing the manual search I've got 28 events.

Doing the search "index=_internal sourcetype=scheduler" in the same time range, I found the 28 events generated by the correlation search, of which, 24 with these parameters:

result_count=0
alert_actions=""
suppressed=0
status=success

and 4 with these parameters:

result_count=1
alert_actions="notable,risk"
suppressed=0
status=success

Why, if I do the manual search (the same as the correlation search) I've got 28 results, instead the correlation search generated only 4 notables?

 

Thank you

Labels (1)
0 Karma
1 Solution

davidem
Engager

I changed the time range from (-6 , -5) to (-11 ,-10) and now the notable generation workes. There are some log sources with different delays. Thank you.

View solution in original post

hettervi
Builder

You haven't activated the alert throttling in the correlation search by chance? That could explain it.

Alternatively, if the alert run frequently over a small timespan, e.g. run each 5 minutes and searches in the last 5 minutes, and there's also a delay in the logs to Splunk, the alert could "miss" the logs. The solution to this would be to add a delay to the search, so that it e.g. searches from -10m to -5m instead of -5m to now.

0 Karma

davidem
Engager

I changed the time range from (-6 , -5) to (-11 ,-10) and now the notable generation workes. There are some log sources with different delays. Thank you.

Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...