https://community.splunk.com/t5/Knowledge-Management/Cleaning-up-orphaned-searches-and-reports/m-p/377945#M6516 <P>We migrated search heads and there was content in user directories from users that have since quit, and therefore no username got created. I get a message that there are orphaned searched. Any advice?</P> Sat, 09 Feb 2019 22:42:56 GMT brent_weaver 2019-02-09T22:42:56Z https://community.splunk.com/t5/Knowledge-Management/Cleaning-up-orphaned-searches-and-reports/m-p/377945#M6516 <P>We migrated search heads and there was content in user directories from users that have since quit, and therefore no username got created. I get a message that there are orphaned searched. Any advice?</P> Sat, 09 Feb 2019 22:42:56 GMT https://community.splunk.com/t5/Knowledge-Management/Cleaning-up-orphaned-searches-and-reports/m-p/377945#M6516 brent_weaver 2019-02-09T22:42:56Z https://community.splunk.com/t5/Knowledge-Management/Cleaning-up-orphaned-searches-and-reports/m-p/377946#M6517 <P>If you can't use the <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches" target="_blank">re-assign objects interface</A> for those searches, then i would suggest either deleting savedsearches.conf from the user ($SPLUNK_HOME/etc/users/the_user/some_app/local/savedsearches.conf) or just delete the user directory all together. If it's shc, you can do that on each member and then a rolling restart.</P> <P>Of course, first ensure those searches should no longer be running. If they should still be running, then just recreate them yourself. </P> Tue, 29 Sep 2020 23:12:12 GMT https://community.splunk.com/t5/Knowledge-Management/Cleaning-up-orphaned-searches-and-reports/m-p/377946#M6517 maciep 2020-09-29T23:12:12Z