When we talk about correlation, is it necessarily because a query is being made in 2 or more sources?

[splunkcol]

A question,

When we talk about correlation, is it necessarily because a query is being made in 2 or more sources?

Or is it also considered correlation when certain criteria are searched in a source to try to find a possible event or security incident?

For you what is correlation in Splunk?

[splunkcol]

From your point of view and experience, is a multi-source correlation process easy or difficult?

Normally when you want to correlate in Splunk and not in Splunk ES, you tend to use subqueries? or combination of tables?

[gcusello]

Hi @splunkcol,

the main problem in Splunk is to know what to do and not how to do it in SPL.

For this reason a correlaton search isn't easy or difficoult, it depends on how deeply I know the data sources I'm using: if I'm managing well known data sources, with all the field extractions and normalizrd data it's easy, using custom data source is longer to implement, not more difficoult!

I rarely use subsearches for their limits (50,000 results) and because each subsearch takes a CPU for all the execution tima, so I prefer a main search with more datasources to correlate using e.g. stats.

Ciao.

Giuseppe

[gcusello · Accepted solution]

Hi @splunkcol,

correlation is a general concept that letteraly means correlate information from different events or sources.

I use to speak of Correlation when I have more than one source.

I don't use to speak of correlation when I'm grouping more events from the same source but it could also be considered a correlation, as you prefer.

In Splunk Enterprise Security a Correlation Search is an alert (from one or more sources) or that usually generates a Notable.

Ciao.

Giuseppe