Getting Data In

How do correlation searches work with other source types if the source types weren't specified in search?

tokio13
Path Finder

Hello everyone,

I have the following question:

For use cases (anything in the Enterprise Security > content), let's say I have 5 sourcetypes.  If I create a new correlation search that I want to work for these 5 sourcetypes that I have the following:

index=something sourcetype=something1 OR sourcetype=something2 OR sourcetype=something3 OR sourcetype=something4 OR sourcetype=something5

That would mean that whenever a new source type is onboarded I would have to manually add it to all the correlation searches that I created or that are by default in Splunk Enterprise Security content.

 

How do other correlation searches work (the ones that come by default with ES) with other source types if the source types weren't specified in the query?

 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

This is why we have macros and eventtypes/tags.  You could create a macro with the list of sourcetypes and use that macro in your CSs.  Any change to the list of sourcetypes means a single change to the macro and all CSs are up-to-date.

Similarly, you could create an eventtype that uses the sourcetypes and put eventtype=foo in your CSs.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

tokio13
Path Finder

This was very insightful! Thank you both
Things have much more sense now

0 Karma

gcusello
Esteemed Legend

Hi @tokio13,

in your correlation search you could use an eventtype containing your five sourcetypes, so when you'll need to add a new sourcetype, you'll have only to update the eventtype.

In addition, it's easier using the IN operator:

index=something sourcetype IN (something1, something2, something3, something4,  something5)

Ciao.

Giuseppe

richgalloway
SplunkTrust
SplunkTrust

This is why we have macros and eventtypes/tags.  You could create a macro with the list of sourcetypes and use that macro in your CSs.  Any change to the list of sourcetypes means a single change to the macro and all CSs are up-to-date.

Similarly, you could create an eventtype that uses the sourcetypes and put eventtype=foo in your CSs.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...