The documentation for Splunk Enterprise Security versions 8.0 and higher have been rearchitected from previous versions, causing some links to have redirect errors. For documentation on version 8.0, see Splunk Enterprise Security documentation homepage.
This documentation does not apply to the most recent version of Splunk® Enterprise Security.
For documentation on the most recent version, go to the latest release.
Create a correlation search
A correlation search is a type of search that evaluates events from one or more data sources for defined patterns. When the search finds a pattern, it creates a notable event, adjusts a risk score, or performs an adaptive response action. A correlation search is a saved search with extended capabilities making it easier to create, edit, and use searches for security use cases.
This tutorial is for users who are comfortable with the Splunk Search Processing Language (SPL) and who understand data models and the Splunk App for Common Information Model.
You will learn how to create a correlation search using the guided search creation wizard.
- Part 1: Plan the use case for the correlation search.
- Part 2: Create a correlation search.
- Part 3: Create the correlation search in guided mode.
- Part 4: Schedule the correlation search.
- Part 5: Choose available adaptive response actions for the correlation search.
- Additional resources for creating a correlation search.
Last modified on 19 January, 2022
| Splunk Enterprise Security tutorials | Part 1: Plan the use case for the correlation search |
This documentation applies to the following versions of Splunk® Enterprise Security: 7.0.0
Download manual
Feedback submitted, thanks!