Changing the ownership of Orphaned searches in Splunk cloud

[santosh_hb]

I would like to change the ownership of a couple of Orphaned searches in Splunk cloud. How can I do it in GUI?
Is it possible to do it in GUI? If yes, please guide me with the steps.

[woodcock]

You generally have several options:

For the desired option (through the Search Head GUI), upgrade to v6.6.* to get the new "Reassign Knowledge Objects" function:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches

From the Search Head CLI or search bar:
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html

From the Search Head CLI with editor:
You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, you can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta. You will have to hit the _bump endpoint to get it to take effect immediately for you or just wait a while (refresh will not be immediate).

From the GUI brute force (works anywhere, even Cloud):
Go the the Saved searches, reports, and alerts configuration page and find your searches and one-by-one, click the Clone link and then the Delete link.

[jkat54]

See if this works:

Go to settings -> searches, reports, and alerts

Find the orphaned searches.

Click on permissions

Change the permissions on the search from private to app/global