Splunk Search

Splunk ES and Correlation searches

revanthammineni
Path Finder

Hello Splunkers.

I'm working on some of the usecases on ES and one of the request that I've got from my upper management is to consolidate all the usecases and their notables and send them a single email everyday. Is there any way that I can do it from the Splunk UI? Please help.

Thanks.

Labels (1)
Tags (2)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi @revanthammineni , assuming I understood your request correctly, then you first need to make sure all those use cases (correlation searches) are generating notable events in order to populate the notable index.

After you do that, it should be as simple as creating another correlation search or even a traditional saved search that reads from index=notable and presents the information in the way you want. Then trigger an email and you are done.

You could also use the notable macro and expand the tokens included within the drilldown fields in order to display a much more richer version of this daily report. Something like:

earliest=-1d@d latest=@d `notable`
| expandtoken rule_title, drilldown_name, rule_description

 

That you can run once a day and will include yesterday's notables.

Let me know if that helps.

Regards,

J

revanthammineni
Path Finder

Thank you for the answer. I was thinking of going through a python script and do it but your answer gave me a hope.
Appreciate it!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!