Splunk ES and Correlation searches

[revanthammineni]

Hello Splunkers.

I'm working on some of the usecases on ES and one of the request that I've got from my upper management is to consolidate all the usecases and their notables and send them a single email everyday. Is there any way that I can do it from the Splunk UI? Please help.

Thanks.

[javiergn]

Hi @revanthammineni , assuming I understood your request correctly, then you first need to make sure all those use cases (correlation searches) are generating notable events in order to populate the notable index.

After you do that, it should be as simple as creating another correlation search or even a traditional saved search that reads from index=notable and presents the information in the way you want. Then trigger an email and you are done.

You could also use the notable macro and expand the tokens included within the drilldown fields in order to display a much more richer version of this daily report. Something like:

earliest=-1d@d latest=@d `notable`
| expandtoken rule_title, drilldown_name, rule_description

That you can run once a day and will include yesterday's notables.

Let me know if that helps.

Regards,

J

[revanthammineni]

Thank you for the answer. I was thinking of going through a python script and do it but your answer gave me a hope.
Appreciate it!