Splunk Enterprise Security

Why are notables not getting created?

zacksoft_wf
Contributor

The correlation I am analyzing has some interesting issue.
1. When I run the SPL code separately in a search bar it has 100s of events, but when I see the Incident Review , I see only a few(very few).
2.. The last line of the correlation search  is  "outputlookup somelookup.csv".     But I see the creator of this lookup hasn't created it's definition. 
could this be the reason why the notables are not getting created ???? 
Also when I see the stats of the correlation it it shows 

Statistics

Avg. Event Count 0 Avg. Result Count 0 Avg. Run Time 0:00:00 Invocations 0 Skipped 0 Success 0

Could anyone confirm if my suspicion is correct that the missing definition of the lookup is prohibiting the notables from being created with no evidence of skips, errors, or suppression in the logs.

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

No, that is not it.  The problem is almost certainly that the value used for the timpicker does not consider the latency of the events until they become searchable in Splunk.  This latency is even larger if you are using accelerated datamodels.  You can calculate and examine the latency by doing "| eval latency = _index_time - _time".  This is why you almost always see timepicker values in good/working content that look like "earliest=@h-1h-15m latest=@-15m" instead of "earliest=-1h latest=now".

View solution in original post

0 Karma

woodcock
Esteemed Legend

No, that is not it.  The problem is almost certainly that the value used for the timpicker does not consider the latency of the events until they become searchable in Splunk.  This latency is even larger if you are using accelerated datamodels.  You can calculate and examine the latency by doing "| eval latency = _index_time - _time".  This is why you almost always see timepicker values in good/working content that look like "earliest=@h-1h-15m latest=@-15m" instead of "earliest=-1h latest=now".

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...