Splunk® Enterprise Security

Splunk Enterprise Security Tutorials

Acrobat logo Download manual as PDF


This documentation does not apply to the most recent version of Splunk® Enterprise Security. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

Additional resources for creating a correlation search

Additional resources to assist you with creating your own correlation searches can be found in the following places.

Data source selection

For information on choosing a data model as a data source, see What data models are included in the Splunk Add-on for Common Information Model.

For information about choosing a lookup table as a data source, see Introduction to lookup configuration in the Knowledge Manager Manual and Create and manage lookups in Splunk Enterprise Security in Use Splunk Enterprise Security.

Defining your search

For information about aggregate functions, see the Splunk platform documentation.

For examples of time modifiers, see the Splunk platform documentation.

Search scheduling

For information on real-time and continuous search scheduling, see the Splunk platform documentation.

For information on search schedule priority, see the Splunk platform documentation.

Alerting conditions

For information on trigger conditions and configuring those conditions for a search, see the Splunk platform documentation.

Notable event details

For details about how to make sure that additional fields appear in the notable event details, see Change notable event fields in Administer Splunk Enterprise Security.

Last modified on 22 November, 2021
PREVIOUS
Part 5: Choose available adaptive response actions for the correlation search
 

This documentation applies to the following versions of Splunk® Enterprise Security: 4.7.0, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5, 4.7.6, 5.0.0, 5.0.1, 5.1.0, 5.1.1, 5.2.0, 5.2.1, 5.2.2, 5.3.0, 5.3.1, 6.0.0, 6.0.1, 6.0.2, 6.1.0, 6.1.1, 6.2.0, 6.3.0 Cloud only, 6.4.0, 6.4.1, 6.5.0 Cloud only, 6.5.1 Cloud only, 6.6.0, 6.6.2


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters