You can edit savedsearch panel and change the REST Endpoint to the updated version From: /services/alerts/correlationsearches To: /services/saved/searches REF. https://answers.splunk.comn/answers/239437/how-to-get-a-complete-list-with-descriptions-of-co.html REF. https://docs.splunk.com/Documentation/ESHealthCheck/1.0.0/UserGuide/Releasenotes 2017-05-10 SOLNESS-12056, SOLNESS-12106 On instances running Splunk Enterprise Security 4.6.0 or later, the Get Enabled Correlation Searches panel does not show results. Workaround: Replace the search with the following syntax: | rest splunk_server=local count=0 /services/saved/searches | search action.correlationsearch.enabled = 1 | stats count as total, count(eval(disabled=0)) as enabled | eval op = enabled . "/" . total | fields op ... View more

I was having the same issue and managed to work around it by using an AWS ELB configured with an ACM certificate. I can confirm that AWS Firehose does recognize ACM generated certificates as valid. See docs at http://docs.splunk.com/Documentation/AddOns/released/Firehose/ConfigureanELB I cannot confirm whether AWS considers lets encrypt as a valid certificate (@bentysontcxn mentioned switching to a different CA solved the issue) BUT note that your HEC may use a different certificate than the web portal. In my case, my web portal was using Let's Encrypt, so I thought I was in the same boat as @bentysontcxn, but later realized the HEC was using a self-signed certificate. To check which certificate is used by the HEC, try https://your-domain.com:8088/services/collector/health/1.0, where 8088 is the HEC listening port. ... View more

Actually this doesn't seem to work even without real-time search - the results are displayed by time and not grouped by jobid at all. ... View more

This is close, but when I use this in a real-time search, the results no longer stayed grouped by jobid. ie. if I get a message for jobid 100 then 200 then 100, it will be displayed 100 .... 200 ... 100 ... The original search would display it as 200 ... 100 ... 100 .... Is there a way to keep it grouped by jobid with real-time results? ... View more