Splunk Search

Splunk ES and Correlation searches

Path Finder

Hello Splunkers.

I'm working on some of the usecases on ES and one of the request that I've got from my upper management is to consolidate all the usecases and their notables and send them a single email everyday. Is there any way that I can do it from the Splunk UI? Please help.


Labels (1)
Tags (2)
0 Karma


Hi @revanthammineni , assuming I understood your request correctly, then you first need to make sure all those use cases (correlation searches) are generating notable events in order to populate the notable index.

After you do that, it should be as simple as creating another correlation search or even a traditional saved search that reads from index=notable and presents the information in the way you want. Then trigger an email and you are done.

You could also use the notable macro and expand the tokens included within the drilldown fields in order to display a much more richer version of this daily report. Something like:

earliest=-1d@d latest=@d `notable`
| expandtoken rule_title, drilldown_name, rule_description


That you can run once a day and will include yesterday's notables.

Let me know if that helps.



Path Finder

Thank you for the answer. I was thinking of going through a python script and do it but your answer gave me a hope.
Appreciate it!

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...