topic Saved Searches not editable after upgrade to 10.2.X version in Splunk Enterprise

Saved Searches not editable after upgrade to 10.2.X version

herguzav — Sun, 15 Mar 2026 10:29:39 GMT

Hi community

I'm searching for your help.

After the Splunk version upgrade from 10.0.1 to 10.2.1, I can't edit my alerts and other saved searches. Do any one have seen this behavior?

Re: Saved Searches not editable after upgrade to 10.2.X version

isoutamo — Sun, 15 Mar 2026 12:10:20 GMT

I haven’t seen things, but please check the next items.
Which license you have? If you have changed from trial to free the you haven’t alerts anymore.
Have you check and ensure that owner for splunk files are correctly set?

Re: Saved Searches not editable after upgrade to 10.2.X version

herguzav — Sun, 15 Mar 2026 12:29:03 GMT

Hello @isoutamo

I have the Splunk "Enterprise Term License - No Enforcement (6.5 )" license and the owner al the splunk files are correct but still I can't edit my own alerts.

Do you have any other suggestion?

Re: Saved Searches not editable after upgrade to 10.2.X version

isoutamo — Mon, 16 Mar 2026 07:30:27 GMT

And you are sure that there there are not too many license violations?

One thing which I also try is stop your splunk and change all file to splunk:splunk ownership. At least with older versions there are time by time when update leaves wrong ownerships especially if you are using tar package instead of rpm/dep.

If those didn't help then you should explain more deeper level what you have (os, version, single node, distributed etc.).