Detections that have special characters might display an error message such as, Search Does Not Exist.

This error message gets displayed if on-premises customers use a reverse proxy. Using Nginx as a reverse proxy in Splunk Enterprise Security might encode special characters that can prevent detections from being discovered by Splunk Enterprise Security.

Clone the detection and remove the special characters in the clone. You can then turn off the original detection. Additionally, you must configure your reverse proxy to not encode special characters.