- Splunk Answers
- :
- Splunk Premium Solutions
- :
- Security Premium Solutions
- :
- Splunk Enterprise Security
- :
- Why are notables not getting created?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The correlation I am analyzing has some interesting issue.
1. When I run the SPL code separately in a search bar it has 100s of events, but when I see the Incident Review , I see only a few(very few).
2.. The last line of the correlation search is "outputlookup somelookup.csv". But I see the creator of this lookup hasn't created it's definition.
could this be the reason why the notables are not getting created ????
Also when I see the stats of the correlation it it shows
Statistics
Avg. Event Count 0 Avg. Result Count 0 Avg. Run Time 0:00:00 Invocations 0 Skipped 0 Success 0
Could anyone confirm if my suspicion is correct that the missing definition of the lookup is prohibiting the notables from being created with no evidence of skips, errors, or suppression in the logs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, that is not it. The problem is almost certainly that the value used for the timpicker does not consider the latency of the events until they become searchable in Splunk. This latency is even larger if you are using accelerated datamodels. You can calculate and examine the latency by doing "| eval latency = _index_time - _time". This is why you almost always see timepicker values in good/working content that look like "earliest=@h-1h-15m latest=@-15m" instead of "earliest=-1h latest=now".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, that is not it. The problem is almost certainly that the value used for the timpicker does not consider the latency of the events until they become searchable in Splunk. This latency is even larger if you are using accelerated datamodels. You can calculate and examine the latency by doing "| eval latency = _index_time - _time". This is why you almost always see timepicker values in good/working content that look like "earliest=@h-1h-15m latest=@-15m" instead of "earliest=-1h latest=now".
Get the T-shirt to Prove You Survived Splunk University Bootcamp
Introducing the Splunk Community Dashboard Challenge!
Wondering How to Build Resiliency in the Cloud?
