Using the search provide in the ES documentation did not list all of the correlation searches in our environment, especially the ones in other apps. I used this search to find them all | rest /servicesNS/-/-/saved/searches splunk_server=local | where match('action.correlationsearch.enabled', "1|[Tt]|[Tt][Rr][Uu][Ee]") ... View more