Correlation search overview for ITSI
A correlation search is a recurring search that scans multiple data sources for defined patterns. You can configure a correlation search to generate a notable event (alert) when search results meet specific conditions. Review notable events that your correlation searches generate in Episode Review and initiate the investigative process of determining root cause.
You can use an ITSI correlation search to ingest third-party alerts as ITSI notable events. If you are creating a correlation search to ingest alerts from a third-party product, such as Nagios or SCOM, see Ingest third-party alerts as ITSI notable events for specific instructions.
Do not create correlation searches by manually editing
$SPLUNK_HOME/etc/apps/itsi/local/savedsearches.conf. The search will not appear on the correlation search lister page. Always create correlation searches directly in the IT Service Intelligence app.
Predefined correlation searches
The following correlation searches are delivered with ITSI. They are all disabled by default except Splunk App for Infrastructure Alerts. You can enable them and modify them to meet your needs.
|Bidirectional Ticketing||Maps an external ticketing system's fields to Common Information Model (CIM) fields to enable bidirectional ticketing. See Enable two-way integration with an external ticketing system in ITSI for information.||Disabled|
|Monitor Critical Service Based on Health Score||Generates notable events for services with a critical health score.||Disabled|
|Normalized Correlation Search||Generates notable events for any third-party alerts being ingested into ITSI that include ITSI normalized fields. See Normalized correlation search for more information.||Disabled|
|SNMP Traps||Generates notable events for SNMP traps being ingested into ITSI. See Ingest SNMP traps in ITSI for more information.||Disabled|
|Splunk App for Infrastructure Alerts||Generates notable events from Splunk App for Infrastructure alerts when you enable integration between the Splunk App for Infrastructure and ITSI. See Ingest Splunk App for Infrastructure alerts into ITSI as notable events for more information.||Enabled|
Group similar events with Smart Mode in ITSI
Create correlation searches in ITSI
This documentation applies to the following versions of Splunk® IT Service Intelligence: 4.2.0, 4.2.1, 4.2.2, 4.2.3, 4.3.0, 4.3.1, 4.4.0, 4.4.1, 4.4.2, 4.4.3, 4.4.4, 4.4.5