Splunk ITSI Correlation search Name

[ManjunathNargun]

hi,

How to identify the correlation search name using the Report name found in skipped searches.

We are trying to resolve the skipped searches issue. Any help would be much appreciated.

ManjunathNargun_1-1693583296515.png

Thanks!

[andrew_nelson]

Extract the search key (The hex string you have redacted) using either split or rex to a field called keyID substituting search_name for whatever the field is called in your data. 

| eval keyID=mvindex(split(search_name, " - "), 1)

OR 

| rex field=search_name "Indicator - (?<keyID>[^\s]+) - "

Then you can use the ITSI API endpoints to tie them to the base searches: 

| join type=left keyID 
    [| rest splunk_server=local /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search report_as=text 
    | eval value=spath(value,"{}") 
    | mvexpand value 
    | eval title = spath(value, "title"), keyID = spath(value, "_key"), frequency = spath(value, "alert_period") 
    | fields title, keyID, frequency ]