Splunk Enterprise Security

Trying to set default disposition of a notable correlation search



I've been trying to build a correlation search that sets a default disposition value when it runs but so far it doesnt work as advertised.  I've tried this one of two ways:


1) manually setting it to a valid value e.g.



| eval disposition="disposition:7"
| eval disposition_label="My cool disposition label"



2) by editing the correlation search in the advanced search editor and setting the parameter myself:


I've tried this with and without quotes, but I still always get a disposition:6 set by default.


I have validated that this disposition and label does exist and is enabled in Incident Review settings, and can manually be set.

Can someone shine some light on what I'm doing wrong?

Many thanks!

Labels (2)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...