- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Alerting
- :
- Why am I unable to find orphaned searches or alert...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I run following search to look for orphaned searches/alerts:
| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1
| eval status = if(disabled = 0, "enabled", "disabled")
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
I found a few which belong to some departed users. However, when I go to Settings>Searches, Reports, and Alerts, they are not listed. I also searched $SPLUNK_HOME/etc/apps to make sure all the departed users' names to be replaced with a current user's name. Yet the same orphaned searches turned up whenever I run the above search. What did I miss?
Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@weicai88,
The issue is that private orphaned objects are not visible through the web interface when search for them, but are report in the orphaned searches report. While orphaned searches which are shared as global or under app context are visible.
This is a known limitation with the current Splunk UI. This will be addressed in the future with anew UI interface. Paraphrasing from a support ticket. I submitted this as a bug and was being tracked under SPL-129613.
The work around is to use the API to manage the orphaned object by either deleting or reassigning it. https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Resolveorphanedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@weicai88,
The issue is that private orphaned objects are not visible through the web interface when search for them, but are report in the orphaned searches report. While orphaned searches which are shared as global or under app context are visible.
This is a known limitation with the current Splunk UI. This will be addressed in the future with anew UI interface. Paraphrasing from a support ticket. I submitted this as a bug and was being tracked under SPL-129613.
The work around is to use the API to manage the orphaned object by either deleting or reassigning it. https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Resolveorphanedsearches
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The link didn't get me to an answer, but this one did: https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches
Specifically this section https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches#Reassign_unsha...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right on, bmacias84! I was able to track down the saved searched in those users' home directory. Thanks for your quick response!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are welcome dont forget to up vote accepted answers. It help me and the post. Cheers
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
