I am not sure if you understood my question rightly !? . This is regarding Splunk Enterprise security App. An security analyst can configure correlation search which scan data and take an action creating a notables. http://docs.splunk.com/Documentation/PCI/3.3.0/Install/Correlationsearches So, it matches against a set of data. does splunk store those matches data in memory or a file before creating a notable. it has to store somewhere before creating a notable. ... View more

Could you please explain me what happens when the correlation search matches a set of events. Does spunk store this in a memory or file before it load it's data to index notable? ... View more

please find my comments inside.!! ... View more

Dear Splunk Team, I am using splunk api (push mech) to retrieve all index notables, so i can see them in the ticketing system!! First i send a query (using splunk api) to the index notables to get all the notables within the timeframe of 5 mins and assume that i have 20 notables and all the 20 notables have the "drill_down" search command. This is just one query. Now i have to hit 20 times in the search head to retrieve all the related events for each notables incidents. (aka) you know the drill-down provide the search for Contributing Events (Drill-down). right ? now i dont want to hit 20 times to get all the drill-down search. A slight change in the approach, can i hold all the events which matched the correlation search of splunk es app, before it get indexed in the notable index. ? so thats like --> Cor.search runs --> (store all the contributing events in a file) --> then allow splunk to index in the index=notable disk. this is where a custom pipeline inside the indexer pipeline should help me to achieve. ... View more

Sure, When I create correlation search it creates notables. once the notables is created in the "index notable" i do a couple of things: 1) I used "Run a script" option to send the notables to another server called "A". 2) Now "A" receives all the notables and it will search for the related events (aka) drilldown search to get all the related events for that incident. its painful process to do it, when i get a 10K incidents per day. what i request: 1) is there any way for me to pull the events when the notable is created, so A needn't do a push method to retrieve all the related events per incidents. What i think: Splunk already should store all the events in memory and once the events are matched by the c.search a notables is created, can i grab that events along with the incidents ? ... View more

convincing for me.. thanks ... View more