Splunk Enterprise Security

Correlation searches scheduling to overcome downtimes and event delays

tibi
Observer

Hello,

 

Hello,

 

Any suggestions on how to configure the correlation search schedule in a way that will not be affected by a maintenance downtime ? 

 

For example if you have a correlation search that is schedule to run every hour at minute 5 for the last hour . how can be configured to cover also the skipped run and to not miss alerts?

 

Thanks.

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you do your correlation search over a couple of hours bucketed by hour, then append the previous results and remove duplicates?

0 Karma

tibi
Observer

thanks for the reply.

 

please can you provide an example how to configure the cs and how to exclude duplicates?

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...