How to set default admin ownership for all new alerts to savedsearches.conf?

[mufthmu]

Hi,

I want to automatically set ownership to admin whenever new alerts are added in savedsearches.conf.

As of now, whenever my team has a new alert I have to add it to the savedsearches.conf AND also local.meta to make it owned by admin with the exact same title written in savedsearches.conf (if it does not match, it doesn't take effect) like the stanza below:

[savedsearches/new alert]
owner = admin

However, I don't want to keep editing 2 different files when 1 alert is created (too much work if we have a lot of new incoming alerts).

There should be a way to set default ownership of alerts (and also dashboards) to admin when they're first created.
I suspect default.meta has something to do with it.

Looking for any suggestion,
Thank you

[ragedsparrow]

By default the owner will be whomever creates the alert/saved search. You can change owner through the configs like you've mentioned, but you can also reassign knowledge objects in the UI (starting with Splunk 7) :

https://docs.splunk.com/Documentation/Splunk/8.0.3/Knowledge/Resolveorphanedsearches#Use_the_Reassig...

I don't believe there is a way to automatically change the owner of a knowledge object without this type of intervention.