Alerting

Why am I unable to find orphaned searches or alerts?

weicai88
Path Finder

I run following search to look for orphaned searches/alerts:

| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 
| search orphan=1 disabled=0 is_scheduled=1 
| eval status = if(disabled = 0, "enabled", "disabled") 
| fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions 
| rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing

I found a few which belong to some departed users. However, when I go to Settings>Searches, Reports, and Alerts, they are not listed. I also searched $SPLUNK_HOME/etc/apps to make sure all the departed users' names to be replaced with a current user's name. Yet the same orphaned searches turned up whenever I run the above search. What did I miss?

Thanks!

1 Solution

bmacias84
Champion

@weicai88,

The issue is that private orphaned objects are not visible through the web interface when search for them, but are report in the orphaned searches report. While orphaned searches which are shared as global or under app context are visible.

This is a known limitation with the current Splunk UI. This will be addressed in the future with anew UI interface. Paraphrasing from a support ticket. I submitted this as a bug and was being tracked under SPL-129613.

The work around is to use the API to manage the orphaned object by either deleting or reassigning it. https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Resolveorphanedsearches

View solution in original post

bmacias84
Champion

@weicai88,

The issue is that private orphaned objects are not visible through the web interface when search for them, but are report in the orphaned searches report. While orphaned searches which are shared as global or under app context are visible.

This is a known limitation with the current Splunk UI. This will be addressed in the future with anew UI interface. Paraphrasing from a support ticket. I submitted this as a bug and was being tracked under SPL-129613.

The work around is to use the API to manage the orphaned object by either deleting or reassigning it. https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Resolveorphanedsearches

Georgiev
Explorer
0 Karma

weicai88
Path Finder

Right on, bmacias84! I was able to track down the saved searched in those users' home directory. Thanks for your quick response!

0 Karma

bmacias84
Champion

You are welcome dont forget to up vote accepted answers. It help me and the post. Cheers

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...