Other Usage

Notables Are Not Being Created

daniaabujuma
Explorer

Hi Splunkers!

I am using Splunk Enterprise Security, and creating correlation searches, one of them I have created and tested manually by running the search over a specific period of time, many events matched, but no notable events are being created. To test my correlation, I have added another action (send email) when the correlation is triggered, and sure enough, an email was sent to me.

Can anyone help me solve this issue?

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @daniaabujuma,

a very stupid question: did you created as Requested Action the Notable creation?

Notable Creation isn't enabled by default.

If yes, check the parameters you used.

Ciao.

Giuseppe

0 Karma

daniaabujuma
Explorer

Hi @gcusello ,

Thanks for the reply.

This is what I did, it works every time without issues but I noticed that recently the newly created correlations aren't creating notables when triggered.

daniaabujuma_0-1694001861474.png

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @daniaabujuma,

check if the options in the Notable crattion are the same of other Notables that are usually triggered.

Ciao.

Giuseppe

0 Karma

daniaabujuma
Explorer

Hello @gcusello ,

Yes everything is the exact same

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @daniaabujuma,

check the Correlation Search Name: it must be different than others, otherwise you cannot distinguish it from the others.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...