Splunk Enterprise Security

Rename existing correlation search Title


Hi Fellows,

I need to change the title of existing correlation search which I am not able to do as the options are greyed out. I am using splunk enterprise security 7.2.6 version and don't have admin access. Is there any way to rename the title ?

Thanks in adv.

Esteemed Legend

It is poor form and will end up making updates to the original app invisible when you upgrade it if you modify the saved search. Instead clone the search and add some kind of prefix to the name so that you can match your cloned saved searches to the originals and then do deltas when you upgrade the app to see if there are changes that you need to pull into your clone. If you do it this way, you should never have permission problems.

0 Karma


Sorry for only stating the obvious: You may only change/edit those knowledge objects, that you have write access rights for. If some option is greyed out, you may want to contact the splunk admin in order to get proper access or for him to change the name for you.


Ok thanks !

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...