Splunk Enterprise Security

Rename existing correlation search Title

Arpmjdr
Explorer

Hi Fellows,

I need to change the title of existing correlation search which I am not able to do as the options are greyed out. I am using splunk enterprise security 7.2.6 version and don't have admin access. Is there any way to rename the title ?

Thanks in adv.

woodcock
Esteemed Legend

It is poor form and will end up making updates to the original app invisible when you upgrade it if you modify the saved search. Instead clone the search and add some kind of prefix to the name so that you can match your cloned saved searches to the originals and then do deltas when you upgrade the app to see if there are changes that you need to pull into your clone. If you do it this way, you should never have permission problems.

0 Karma

ololdach
Builder

Sorry for only stating the obvious: You may only change/edit those knowledge objects, that you have write access rights for. If some option is greyed out, you may want to contact the splunk admin in order to get proper access or for him to change the name for you.

Arpmjdr
Explorer

Ok thanks !

0 Karma
Get Updates on the Splunk Community!

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...

AI Adoption Hub Launch | Curated Resources to Get Started with AI in Splunk

Hey Splunk Practitioners and AI Enthusiasts! It’s no secret (or surprise) that AI is at the forefront of ...