Splunk Enterprise Security

how to ensure that splunk correlation rules are running continuously in background

saurabh_tek11
Communicator

I see some searches apparently are running but since the user activity is less these days so cant confirm if those events are happening which violates the many of the OOB correlations rule. Other the other hand, log ingestion is no less.

how to ensure that splunk correlation rules are running continuously in background and there is no issue from the searches side.

0 Karma

Splunker
Communicator

Correlation searches are just searches at the end of the day, running on a schedule.

You could do a search like..

index=_internal sourcetype=scheduler savedsearch_name=part_match

Look for a successful run and there should be an evcount (event count) field with a value of 0 or more if it returned any result (depends on your search if no events returned is normal or not).

Also important is the 'status' field which says if it ran, was delegated, deferred, or skipped by Splunks scheduler.

Please forgive any minor inaccuracies of fields, I'm not in front of a PC at the moment 🙂

Cheers.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...