I created a search under ES's Configure > Content > Content Management but it appears under Searches, Reports and Alerts.
So, I wonder about the relation between these two locations.
Correlation searches are Saved searches, so they appears in "Searches, Reports, and Alerts"
In earlier versions, correlation searches could be split between correlationsearches.conf and savedsearches.conf
In the current version, all correlation search configuration is in savedsearches.conf and correlationsearches has been deprecated.
Correlation searches are Saved searches, so they appears in "Searches, Reports, and Alerts"
In earlier versions, correlation searches could be split between correlationsearches.conf and savedsearches.conf
In the current version, all correlation search configuration is in savedsearches.conf and correlationsearches has been deprecated.