Splunk IT Service Intelligence

Splunk ITSI Correlation search Name

New Member


How to identify the correlation search name using the Report name found in skipped searches.

We are trying to resolve the skipped searches issue. Any help would be much appreciated.




Labels (1)
0 Karma


Extract the search key (The hex string you have redacted) using either split or rex to a field called keyID substituting search_name for whatever the field is called in your data. 


| eval keyID=mvindex(split(search_name, " - "), 1)




| rex field=search_name "Indicator - (?<keyID>[^\s]+) - "



Then you can use the ITSI API endpoints to tie them to the base searches: 


| join type=left keyID 
    [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text 
    | eval value=spath(value,"{}") 
    | mvexpand value 
    | eval title = spath(value, "title"), keyID = spath(value, "_key"), frequency = spath(value, "alert_period") 
    | fields title, keyID, frequency ]  


0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...