- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- How to delete a correlation search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers.
I'm looking for a way to delete a correlation search that has been created with the wrong name (as ES doesn't let you rename them).
The CS is currently disabled but I don't see a way to actually delete it.
I see some previous answers here but they involve direct access to the .conf file which isn't an option in this particular environment, so looking for a way to do this from the SH.
Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh okay, in that case, go under : Settings > Searches, reports, and alerts
You should be able to see your saved search there and delete it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @torowa,
If it's one of the OOTB use cases it's best to simply disable it. Deleting it from the default configuration file will be temporary since the next time ES is upgraded the default configuration files are re-installed and the CS will show back up again.
Cheers,
David
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Unfortunately this is a custom Correlation Search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Oh okay, in that case, go under : Settings > Searches, reports, and alerts
You should be able to see your saved search there and delete it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @DavidHourani.
That did the trick.
I didn't realize that correlation searches could be deleted back with the other searches.
Was trying to do this from the Content Management screen from within ES.
Fueling your curiosity with new Splunk ILT and eLearning courses
Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...
Unleash Unified Security and Observability with Splunk Cloud Platform
