https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-correlation-searches-problem/m-p/418389#M5115 <P>Hello,</P> <P>I have figured out a strange behavior of Splunk correlation searches. I'm using Splunk Enterprise version 7.0.1 and ES version 4.7.4.<BR /> I created a new app to store my custom correlation searches and ensured that it is accepted by Enterprise Security by naming it TA-custom-correlation-searches.<BR /> Inside that app I created under local a savedsearches.conf configuration with the following content.</P> <PRE><CODE>#comment1 [Threat - correlation_search_1 - Rule] configuration1=... configuration2=... .... #comment2 #comment3 #comment4 #comment5 [Threat - corelation_search_2 - Rule] configuration1=... configuration2=... .... #comment6 </CODE></PRE> <P>Both correlation searches work as expected. At this point everything is fine.<BR /> Now, I disable both correlation searches in the ES app under Content Management and afterwards I took a look into my savedsearches.conf:</P> <PRE><CODE>#comment1 [Threat - correlation_search_1 - Rule] configuration1=... configuration2=... .... [Threat - corelation_search_2 - Rule] configuration1=... configuration2=... .... #comment6 </CODE></PRE> <P>Splunk deleted all comments between the two correlation searches.<BR /> Did somebody figure out the same issue?<BR /> Thank you for your help.</P> <P>Best regards,<BR /> Patrick</P> Fri, 25 May 2018 07:44:03 GMT BAPA157 2018-05-25T07:44:03Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-correlation-searches-problem/m-p/418389#M5115 <P>Hello,</P> <P>I have figured out a strange behavior of Splunk correlation searches. I'm using Splunk Enterprise version 7.0.1 and ES version 4.7.4.<BR /> I created a new app to store my custom correlation searches and ensured that it is accepted by Enterprise Security by naming it TA-custom-correlation-searches.<BR /> Inside that app I created under local a savedsearches.conf configuration with the following content.</P> <PRE><CODE>#comment1 [Threat - correlation_search_1 - Rule] configuration1=... configuration2=... .... #comment2 #comment3 #comment4 #comment5 [Threat - corelation_search_2 - Rule] configuration1=... configuration2=... .... #comment6 </CODE></PRE> <P>Both correlation searches work as expected. At this point everything is fine.<BR /> Now, I disable both correlation searches in the ES app under Content Management and afterwards I took a look into my savedsearches.conf:</P> <PRE><CODE>#comment1 [Threat - correlation_search_1 - Rule] configuration1=... configuration2=... .... [Threat - corelation_search_2 - Rule] configuration1=... configuration2=... .... #comment6 </CODE></PRE> <P>Splunk deleted all comments between the two correlation searches.<BR /> Did somebody figure out the same issue?<BR /> Thank you for your help.</P> <P>Best regards,<BR /> Patrick</P> Fri, 25 May 2018 07:44:03 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-ES-correlation-searches-problem/m-p/418389#M5115 BAPA157 2018-05-25T07:44:03Z