Splunk Enterprise Security

Rename existing correlation search Title

Arpmjdr
Explorer

Hi Fellows,

I need to change the title of existing correlation search which I am not able to do as the options are greyed out. I am using splunk enterprise security 7.2.6 version and don't have admin access. Is there any way to rename the title ?

Thanks in adv.

woodcock
Esteemed Legend

It is poor form and will end up making updates to the original app invisible when you upgrade it if you modify the saved search. Instead clone the search and add some kind of prefix to the name so that you can match your cloned saved searches to the originals and then do deltas when you upgrade the app to see if there are changes that you need to pull into your clone. If you do it this way, you should never have permission problems.

0 Karma

ololdach
Builder

Sorry for only stating the obvious: You may only change/edit those knowledge objects, that you have write access rights for. If some option is greyed out, you may want to contact the splunk admin in order to get proper access or for him to change the name for you.

Arpmjdr
Explorer

Ok thanks !

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...