https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478627#M7610 <P>From an ES dashboard select Configure-&gt;Content-&gt;Content management. Click the "Create New Content" button and select "Correlation Search". Fill in the form and click Save.</P> Thu, 02 Jan 2020 19:43:31 GMT richgalloway 2020-01-02T19:43:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478625#M7608 <P>Hi ,</P> <P>How to create custom correlation search is ES app. For eg: Traffic to suspicious country</P> Thu, 02 Jan 2020 18:06:38 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478625#M7608 VijaySrrie 2020-01-02T18:06:38Z https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478626#M7609 <P>The easiest way is to find one that is already very similar, go to the CLI and edit <CODE>savedsearches.conf</CODE> and copy the entire stanza, rename the search, and update the <CODE>search</CODE> and other settings, accordingly.</P> Thu, 02 Jan 2020 19:42:14 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478626#M7609 woodcock 2020-01-02T19:42:14Z https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478627#M7610 <P>From an ES dashboard select Configure-&gt;Content-&gt;Content management. Click the "Create New Content" button and select "Correlation Search". Fill in the form and click Save.</P> Thu, 02 Jan 2020 19:43:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/To-create-correlation-search/m-p/478627#M7610 richgalloway 2020-01-02T19:43:31Z