Splunk Enterprise Security
Highlighted

How to remove custom correlation searches in Splunk Enterprise Security?

Path Finder

IF an error is made when creating a correlation search - like using the wrong app context, and you'd like to remove that search and re-apply it.

What are the steps pls ?

Found a couple of answer posts referring this but they are quite old and list nothing stepwise.

gratzi

Highlighted

Re: How to remove custom correlation searches in Splunk Enterprise Security?

Splunk Employee
Splunk Employee

It's best to just disable the "wrong" one and start over with a new one, without removing the old search.

  • *

If you want to remove a custom correlation search entirely, you'd have to remove all traces of it from correlationsearches.conf and savedsearches.conf.
* If you are on version 4.7.0 or later, you can delete the correlation search like you would any saved search in Settings, because the correlationsearches.conf file is no longer used as of version 4.7.0.