I have correlation searches in ES that are not generating notable events as they should be. When I click on content management and find a search that isn't working, it shows a green check mark next to the index but a red exclamation mark next to the sourcetype, saying that there have been no events in that sourcetype for the last 24 hours.
I want to know if this is the cause of my issue, and what I can do to troubleshoot it. I see there are events in the sourcetype/index specified, and they are visible in the search box of the ES app.
What is the name of the Correlational Search that is having this issue?
If you are sure that the index and sourcetype has the data it requires, is it possible that you are missing a Technical Addon that maps the data into a CIM format?