Splunk Enterprise Security

how to ensure that splunk correlation rules are running continuously in background

saurabh_tek11
Communicator

I see some searches apparently are running but since the user activity is less these days so cant confirm if those events are happening which violates the many of the OOB correlations rule. Other the other hand, log ingestion is no less.

how to ensure that splunk correlation rules are running continuously in background and there is no issue from the searches side.

0 Karma

Splunker
Communicator

Correlation searches are just searches at the end of the day, running on a schedule.

You could do a search like..

index=_internal sourcetype=scheduler savedsearch_name=part_match

Look for a successful run and there should be an evcount (event count) field with a value of 0 or more if it returned any result (depends on your search if no events returned is normal or not).

Also important is the 'status' field which says if it ran, was delegated, deferred, or skipped by Splunks scheduler.

Please forgive any minor inaccuracies of fields, I'm not in front of a PC at the moment 🙂

Cheers.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...