×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
SushmaK
New Member
Member since: ‎07-04-2023
‎07-04-2023
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎07-04-2023
View All

Re: List of Disabled / Enabled Correlation Searche...

by in Splunk Enterprise Security
‎07-04-2023 07:38 AM
‎07-04-2023 07:38 AM
Hi @richgalloway  Thanks for the reply! Currently I'm using the below query to fetch the full list of Correlation search:- | rest splunk_server=local count=0 /services/saved/searches | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") | rename action.correlationsearch.label as Alert_Name,action.correlationsearch.annotations as frameworks,updated as Last_Updated | table Alert_Name, frameworks, disabled, Last_Updated | spath input=frameworks | table Alert_Name,disabled,Last_Updated The place where I'm facing the difficulty is, I'm unable to search the disabled or enabled CS in a particular time(for ex: 7days). Need help on this.   ... View more

List of Disabled / Enabled Correlation Searches in...

by in Splunk Enterprise Security
‎07-04-2023 04:48 AM
‎07-04-2023 04:48 AM
How can I get a list of disabled or enabled correlation searches in last 7 days? As of now, I have a query to fetch the full list of all the correlation searches with disabled and enabled status. But I'm unable to fetch the correlation search list which are enabled or disabled in last 7 days. Please help me out. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎07-04-2023 10:59 AM