- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Changing the ownership of Orphaned searches in Splunk cloud
I would like to change the ownership of a couple of Orphaned searches in Splunk cloud. How can I do it in GUI?
Is it possible to do it in GUI? If yes, please guide me with the steps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You generally have several options:
For the desired option (through the Search Head GUI), upgrade to v6.6.* to get the new "Reassign Knowledge Objects" function:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches
From the Search Head CLI or search bar:
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html
From the Search Head CLI with editor:
You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local
, you can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta
. You will have to hit the _bump
endpoint to get it to take effect immediately for you or just wait a while (refresh will not be immediate).
From the GUI brute force (works anywhere, even Cloud):
Go the the Saved searches, reports, and alerts
configuration page and find your searches and one-by-one, click the Clone
link and then the Delete
link.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

See if this works:
Go to settings -> searches, reports, and alerts
Find the orphaned searches.
Click on permissions
Change the permissions on the search from private to app/global
