Rename existing correlation search Title

[Arpmjdr]

Hi Fellows,

I need to change the title of existing correlation search which I am not able to do as the options are greyed out. I am using splunk enterprise security 7.2.6 version and don't have admin access. Is there any way to rename the title ?

Thanks in adv.

[woodcock]

It is poor form and will end up making updates to the original app invisible when you upgrade it if you modify the saved search. Instead clone the search and add some kind of prefix to the name so that you can match your cloned saved searches to the originals and then do deltas when you upgrade the app to see if there are changes that you need to pull into your clone. If you do it this way, you should never have permission problems.

[ololdach]

Sorry for only stating the obvious: You may only change/edit those knowledge objects, that you have write access rights for. If some option is greyed out, you may want to contact the splunk admin in order to get proper access or for him to change the name for you.

[Arpmjdr]

Ok thanks !