Explanation
The way to navigate to the list of currently-enabled ES correlation searches is to use the Content Management page in Splunk Enterprise Security. The Content Management page allows you to view, enable, disable, and edit the content items that are included in Splunk Enterprise Security, such as correlation searches, dashboards, reports, and lookups. To access the Content Management page, you need to select Configure > Content > Content Management from the Splunk ES menu bar. Then, you can filter the content items by Type and Status to view only the correlation searches that are enabled. You can also use other filters, such as App, Domain, or Owner, to further refine your view12. References = 1: Content Management - Splunk Documentation - View content items. 2: Content Management - Splunk Documentation - Enable or disable content items.