diff --git a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml
index f991b76a5f..175cd974a4 100644
--- a/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml
+++ b/detections/application/splunk_http_response_splitting_via_rest_spl_command.yml
@@ -8,7 +8,7 @@ type: Hunting
 data_source:
 - audittrail
 description: A low-privileged user, using a specially crafted search command, can trigger an HTTP response splitting vulnerability with the rest SPL command that lets them potentially access other REST endpoints in the system arbitrarily, including accessing restricted content such as password files. This is because the user is able to inject the rest SPL command into the q parameter of an HTTP GET web request. The vulnerability requires the attacker to phish the victim by tricking them into initiating a request within their browser. The attacker cannot exploit the vulnerability at will.
-search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="*audit_searches*" | table user info has_error_msg search _time  | `splunk_http_response_splitting_via_rest_spl_command_filter`'
+search: '`audit_searches` AND search IN ("*|*rest*POST*","*|*rest*PUT*","*|*rest*PATCH*","*|*rest*DELETE*") AND NOT search="index=_audit" | table user info has_error_msg search _time  | `splunk_http_response_splitting_via_rest_spl_command_filter`'
 how_to_implement: This detection does not require you to ingest any new data. The detection does require the ability to search the _audit index. This search may assist in detecting possible http response splitting exploitation attemptss. 
 known_false_positives: This search may have produce false positives as malformed or erroneous requests made to this endpoint may be executed willingly or erroneously by operators. 
 references: