Troubleshoot detections with special characters

Issue

Detections that have special characters might display an error message such as, Search Does Not Exist.

Cause

This error message gets displayed if on-premises customers use a reverse proxy. Using Nginx as a reverse proxy in Splunk Enterprise Security might encode special characters that can prevent detections from being discovered by Splunk Enterprise Security.

Solution

Clone the detection and remove the special characters in the clone. You can then turn off the original detection. Additionally, you must configure your reverse proxy to not encode special characters.