Hi Splunk Folks,
I experience strange behavior after upgrading from 7.0.2 to 7.1.1. After the change we noticed that multiple Correlation Searches normally accessible from Content Management have been somehow "transformed" into Saved Searches and stopped being scheduled. Also many of them when expanding shows Error "No associated objects or datasets found."
Additionally, correlation searches which remained in normal shape are opening the CS edit menu like expected, while these which "transformed" to Saved Searches are taking me to Search, reports, and alerts menu.
In savedsearches.conf we indeed see all which are corrupted are missing "action.correlationsearch.enabled" and other fields related to correlation searches.
Any ideas what might have happened? Have not found similar issues desribed over the web.
