Splunk Enterprise Security

How to remove custom correlation searches in Splunk Enterprise Security?

Path Finder

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it.

What are the steps pls ?

Found a couple of answer posts referring this but they are quite old and list nothing stepwise.


Splunk Employee
Splunk Employee

It's best to just disable the "wrong" one and start over with a new one, without removing the old search.

  • *

If you want to remove a custom correlation search entirely, you'd have to remove all traces of it from correlationsearches.conf and savedsearches.conf.
* If you are on version 4.7.0 or later, you can delete the correlation search like you would any saved search in Settings, because the correlationsearches.conf file is no longer used as of version 4.7.0.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...