Splunk Enterprise Security

How to remove custom correlation searches in Splunk Enterprise Security?

Skins
Path Finder

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it.

What are the steps pls ?

Found a couple of answer posts referring this but they are quite old and list nothing stepwise.

gratzi

smoir_splunk
Splunk Employee
Splunk Employee

It's best to just disable the "wrong" one and start over with a new one, without removing the old search.

  • *

If you want to remove a custom correlation search entirely, you'd have to remove all traces of it from correlationsearches.conf and savedsearches.conf.
* If you are on version 4.7.0 or later, you can delete the correlation search like you would any saved search in Settings, because the correlationsearches.conf file is no longer used as of version 4.7.0.

First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...