Splunk Search

Splunk ES and Correlation searches

revanthammineni
Path Finder

Hello Splunkers.

I'm working on some of the usecases on ES and one of the request that I've got from my upper management is to consolidate all the usecases and their notables and send them a single email everyday. Is there any way that I can do it from the Splunk UI? Please help.

Thanks.

Labels (1)
Tags (2)
0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi @revanthammineni , assuming I understood your request correctly, then you first need to make sure all those use cases (correlation searches) are generating notable events in order to populate the notable index.

After you do that, it should be as simple as creating another correlation search or even a traditional saved search that reads from index=notable and presents the information in the way you want. Then trigger an email and you are done.

You could also use the notable macro and expand the tokens included within the drilldown fields in order to display a much more richer version of this daily report. Something like:

earliest=-1d@d latest=@d `notable`
| expandtoken rule_title, drilldown_name, rule_description

 

That you can run once a day and will include yesterday's notables.

Let me know if that helps.

Regards,

J

revanthammineni
Path Finder

Thank you for the answer. I was thinking of going through a python script and do it but your answer gave me a hope.
Appreciate it!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...