How to remove custom correlation searches in Splunk Enterprise Security?

[Skins]

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it.

What are the steps pls ?

Found a couple of answer posts referring this but they are quite old and list nothing stepwise.

gratzi

[smoir_splunk]

It's best to just disable the "wrong" one and start over with a new one, without removing the old search.

• *

If you want to remove a custom correlation search entirely, you'd have to remove all traces of it from correlationsearches.conf and savedsearches.conf.
* If you are on version 4.7.0 or later, you can delete the correlation search like you would any saved search in Settings, because the correlationsearches.conf file is no longer used as of version 4.7.0.