Splunk Enterprise Security

How to remove custom correlation searches in Splunk Enterprise Security?

Path Finder

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it.

What are the steps pls ?

Found a couple of answer posts referring this but they are quite old and list nothing stepwise.


Splunk Employee
Splunk Employee

It's best to just disable the "wrong" one and start over with a new one, without removing the old search.

  • *

If you want to remove a custom correlation search entirely, you'd have to remove all traces of it from correlationsearches.conf and savedsearches.conf.
* If you are on version 4.7.0 or later, you can delete the correlation search like you would any saved search in Settings, because the correlationsearches.conf file is no longer used as of version 4.7.0.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...