The answers already given are spot on. When I am trying to troubleshoot my correlation searches, the first thing I do is grab the query that is being used for the correlation search and validate that it actually returns results. Do a copy and paste from the search query in the correlation search to an SPL window to validate that you don't actually mistype things. If you get results from the query, than you want to validate that adaptive response is set (in ES versions before Splunk 😎 to make a notable. In ES 8 you will want to make sure that event finding option is selected The other type of finding goes into a risk score and will not actually create a finding for you in analyst queue. If none of that works, I tend to copy the correlation search query off to another safe location and replace the query with something that for sure will fire index=_internal | head 1 | table index, sourcetype Then see if that search will fire off an alert, if it doesn't you know that you have a configuration setting messed up in the correlation search. Hope this helps
... View more
