topic Re: How to copy savedsearches.conf from one user to another? in Security

How to copy savedsearches.conf from one user to another?

hartfoml — Mon, 22 Sep 2014 20:35:08 GMT

I have a user that use to run reports for his group. he has left the company. Since I am using scripted authentication most of the users profile information does not show up in the management GUI. I can see the savedsearches.conf for for the departed user and I would like to copy the entire saved search into the new employees profile so that they can take over the responsibilities. I am concerned about the VSID number and what it will mean if I copy or don't copy this number into the new employees profile?

Will this cause a problems when I copy the saved search to the new profile?

Re: How to copy savedsearches.conf from one user to another?

somesoni2 — Mon, 22 Sep 2014 21:30:47 GMT

You can remove the vsid attribute from savedsearches.conf and move the file to new user's profile. A Splunk refresh (http(s)://splunk_servver:port/en-US/debug/refresh) or restart will be required.

Re: How to copy savedsearches.conf from one user to another?

skender27 — Thu, 15 Sep 2016 13:09:03 GMT

Hi,

I almost have the same issue.
Does it work (removing the row vsid) also when you copy the savedsearch.conf file from an old Splunk Enterprise to a new one?

Thanks,
Skender

Re: How to copy savedsearches.conf from one user to another?

somesoni2 — Thu, 15 Sep 2016 14:06:44 GMT

Yes...!!!!