- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Rename existing correlation search Title
Hi Fellows,
I need to change the title of existing correlation search which I am not able to do as the options are greyed out. I am using splunk enterprise security 7.2.6 version and don't have admin access. Is there any way to rename the title ?
Thanks in adv.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It is poor form and will end up making updates to the original app invisible when you upgrade it if you modify the saved search. Instead clone the search and add some kind of prefix to the name so that you can match your cloned saved searches to the originals and then do deltas when you upgrade the app to see if there are changes that you need to pull into your clone. If you do it this way, you should never have permission problems.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Sorry for only stating the obvious: You may only change/edit those knowledge objects, that you have write access rights for. If some option is greyed out, you may want to contact the splunk admin in order to get proper access or for him to change the name for you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok thanks !
