From 7f38ff17aafd832e0a6a3c6cadd3d90102414252 Mon Sep 17 00:00:00 2001
From: "Ioannis L." <44038245+blitzcrieg1@users.noreply.github.com>
Date: Sun, 23 Aug 2026 13:19:32 +0300
Subject: [PATCH] docs(splunk): fix disposition join key to
 correlation_id::rule_id

Single-colon joins silently miss every closure. Matches disposition.py
detection_key and the enterprise TA saved searches.
---
 docs/integrations/fleet-via-siem.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/integrations/fleet-via-siem.md b/docs/integrations/fleet-via-siem.md
index 7070b67..17242ca 100644
--- a/docs/integrations/fleet-via-siem.md
+++ b/docs/integrations/fleet-via-siem.md
@@ -91,9 +91,9 @@ anyone acted, so this count is the real health metric for the deployment.
 
 ```
 index=agentmetry action.type=detection
-| eval key=correlation_id.":".'detection.rule_id'
+| eval key=correlation_id."::".'detection.rule_id'
 | search NOT [ search index=agentmetry action.type=detection_disposition
-               | eval key=correlation_id.":".'disposition.rule_id' | fields key ]
+               | eval key=correlation_id."::".'disposition.rule_id' | fields key ]
 | stats count by host_id, detection.rule_id
 ```