How to delete duplicate correlation searches names in the Enterprise Security (ES) incident review drop down list

Available Languages

Updated:September 28, 2026
Document ID:SPLK044411

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise Security

Description

Creating new correlation searches from existing correlation searches can cause duplicate names in the incident review drop down list.

When the correlation searches run, they will can create notable events, these events are linked to those searches.
As these events may need to investigate these notable events in the future, the correlation searches which triggering these events are kept, this can lead to duplicate names being shown.

If you are sure you will not need to investigate these older notables related to these searches the duplicates names can be deleted.
If you think you may need to investigate them it's better to leave the duplicates.

A search called "Threat - Correlation Searches - Lookup Gen" runs and creates the correlation search rule names, it appends the names to a kvstore called correlationsearches_lookup.

It is possible to delete duplicates, but as mentioned above this may impact investigations of previous events.

 

Investigation

From the ES incident review you may see duplicate names.

Knowledge__kav-Investigation__c2019-10-15 12-25-12.png


Resolution

Deleting the duplicate entries.

1) Make a backup copy of the kvstore, running the file and export this to a CSV file, this can be used to recover this kvstore if needed.
  
| inputlookup correlationsearches_lookup

2) To delete a duplicate, run a search removing the duplicate name and them overwriting this back to the kvstore.
In this example, I have used the rule name "01.XYZ Duplicate search". Please change this to any duplicate name you wish to remove.
  
| inputlookup correlationsearches_lookup | search rule_name != "01.XYZ Duplicate search" 
| outputlookup correlationsearches_lookup

When the search "01.XYZ Duplicate search" runs again the missing rule name should be populated in the kvstore, showing up in the list again.

As you have a copy of the kvstore in CSV, it can be made as a lookup file, then used to overwrite the kvstore correlationsearches_lookup and recreate it from the backup.

Splunk Answers

Why is the ES Incident Review page still lists deleted Correlation Searches in the Multiselect box "Correlation Search Name"?

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco