Within a correlation search, how can a service be associated?

Question

Options

• ABy specifying an appropriate time range.
• BBy adding the service name to the service field.
• CBy modifying correlation_searches.conf
• DBy using lookup in the ad hoc search.

• A
  4% (1)
• B
  92% (23)
• C
  4% (1)

Explanation

Option B is correct because Splunk ITSI correlation searches include a service field where you explicitly specify which service(s) the search is associated with. When a correlation search triggers a notable event, that event is then linked to the named service, enabling service health scoring and episode grouping within ITSI.

Why the distractors are wrong:

• A (Time range) - The time range controls when the search runs and what data it analyzes, not which service it belongs to. It has no role in service association.
• C (correlation_searches.conf) - While this conf file stores correlation search settings, directly editing it is not the standard method for associating a service; that association is made through the service field in the UI (which writes to the conf under the hood).
• D (Lookup in ad hoc search) - Lookups enrich search results with external data; they are unrelated to associating a correlation search with a service.

Memory tip: Think "field = association." Just as you tag events with field-value pairs in Splunk, you tag a correlation search to a service by putting the service's name directly in the service field - it's the most direct, explicit link possible.

No community discussion yet for this question.