https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235405#M188538 <P>from <A href="https://answers.splunk.com/answers/418132/orphaned-scheduled-search-doesnt-work.html" target="_blank">https://answers.splunk.com/answers/418132/orphaned-scheduled-search-doesnt-work.html</A><BR /> please check <BR /> | rest splunk_server=local /services/saved/searches add_orphan_field=1<BR /> or<BR /> | rest splunk_server=local /services/saved/searches<BR /> or <BR /> | rest /servicesNS/-/-/saved/searches add_orphan_field=yes count=0</P> Tue, 29 Sep 2020 12:33:00 GMT inventsekar 2020-09-29T12:33:00Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235404#M188537 <P>After migrating to 6.4.1, we are now notified of orphaned objects. Cleaned them up or cloned them to new ones, but one remains:</P> <P>Splunk has found 1 orphaned searches owned by 1 unique disabled users. Click to view the orphaned scheduled searches. Reassign them to a valid user to re-enable or alternatively disable the searches.<BR /> I have the admin role and user context/app all, but I'm still not able to locate the user/search name. Is there some way to rebuild any repository or config files? It now seems there's some ghost object in the system.</P> Tue, 23 Aug 2016 08:18:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235404#M188537 tweaktubbie 2016-08-23T08:18:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235405#M188538 <P>from <A href="https://answers.splunk.com/answers/418132/orphaned-scheduled-search-doesnt-work.html" target="_blank">https://answers.splunk.com/answers/418132/orphaned-scheduled-search-doesnt-work.html</A><BR /> please check <BR /> | rest splunk_server=local /services/saved/searches add_orphan_field=1<BR /> or<BR /> | rest splunk_server=local /services/saved/searches<BR /> or <BR /> | rest /servicesNS/-/-/saved/searches add_orphan_field=yes count=0</P> Tue, 29 Sep 2020 12:33:00 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235405#M188538 inventsekar 2020-09-29T12:33:00Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235406#M188539 <P>I tried all 3 commands and none seemed to identify orphaned searches. maybe I am not sure how to interpret the output.</P> Thu, 26 Jan 2017 19:30:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235406#M188539 darlas 2017-01-26T19:30:01Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235407#M188540 <P>this works in 6.4.4.</P> <PRE><CODE>| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 | search orphan=1 disabled=0 is_scheduled=1 | eval status = if(disabled = 0, "enabled", "disabled") | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing </CODE></PRE> Thu, 26 Jan 2017 19:50:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235407#M188540 yahuja_splunk 2017-01-26T19:50:48Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235408#M188541 <P>Hi.</P> <P>Thanks for this idea. I get "connection failed with Read timeout" when I run this.</P> <P>I'm on 6.5.1 so maybe this no longer works in latest version?</P> Thu, 26 Jan 2017 20:20:03 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235408#M188541 darlas 2017-01-26T20:20:03Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235409#M188542 <P>may be. i am not sure. </P> Thu, 26 Jan 2017 20:56:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235409#M188542 yahuja_splunk 2017-01-26T20:56:30Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235410#M188543 <P>works fine here on 6.5.1. does executing the first line only give output? (and yeah first time got the '5.' included in the copy/paste which of course does not work ;))</P> Fri, 27 Jan 2017 14:18:19 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235410#M188543 tweaktubbie 2017-01-27T14:18:19Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235411#M188544 <P>@darlas Did you get a solution to this? I upgraded to 6.5.2 and facing the same "connection failed with Read timeout" situation.</P> Sun, 09 Apr 2017 04:26:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235411#M188544 pradeepkumarg 2017-04-09T04:26:20Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235412#M188545 <P>sorry no solution. just living with the orphaned searches for now. sorry to not be of any help to you.</P> Mon, 10 Apr 2017 16:19:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235412#M188545 darlas 2017-04-10T16:19:22Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235413#M188546 <P>Try removing the splunk_server=local within the first | rest query.<BR /> This one worked for me:<BR /> | rest /servicesNS/-/-/saved/searches add_orphan_field=yes count=0<BR /> | search orphan=1 disabled=0 is_scheduled=1<BR /> | eval status = if(disabled = 0, "enabled", "disabled")<BR /> | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions<BR /> | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing</P> Tue, 29 Sep 2020 14:05:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235413#M188546 christian_l 2020-09-29T14:05:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235414#M188547 <P>Try this..</P> <P>| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 <BR /> | search orphan=1 disabled=0 is_scheduled=1 <BR /> | eval status = if(disabled = 0, "enabled", "disabled") <BR /> | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions <BR /> | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing</P> Tue, 29 Sep 2020 16:15:20 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235414#M188547 dhruv05 2020-09-29T16:15:20Z https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235415#M188548 <P>Yes that is the most correct answer. Thanks Yahuja.</P> Fri, 23 Mar 2018 09:49:04 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-find-an-orphaned-search-in-Splunk-6-4-1/m-p/235415#M188548 duartet 2018-03-23T09:49:04Z