Deployment Architecture

How to change the ownership of an object in a Splunk version 6.x search head cluster?


A method previously used with SH Pooling no longer seems to work for search heads in a search head cluster. In the documentation, for changing object ownership, it advises changing the owner of the object, but does not indicate how to do it:

> 3. For any searches or objects that the user owns, change the owner. You
> change it an admin user or maintenance
> account, or whatever you prefer.

(The grammar is also incorrect 🙂


If you are running version 6.6.x or higher, here is the EASY method:
- On a member of the search head cluster (or your single instance)... Settings-->All Configurations-->Click Reassign Knowledge Objects
- Sort by whatever you need to change (user usually) select the objects taking note of their app association
- Use the checkboxes on the left to select, then click the selected item count above the checkboxes to modify ownership on these objects. Be sure to select ownership which has access to the relevant indexes.

Splunk Employee
Splunk Employee

1) You change the ownership for any objects owned by the user on the deployer - manual editing.
Use the same method as stated here;

2) Then move to SHCluster captain, use REST call to change the ownership of objects owned by the user.
Find the REST call below for reference;

You may want to run below as best practice after saved search object ownership have changed so that they are still scheduled correctly.
./splunk _internal call /servicesNS///saved/searches/_reload

This has been improved in 6.6 - we have a GUI, reassign knowledge object you can do this via GUI instead of REST call.

3) Push the bundle from deployer.

0 Karma

Revered Legend

I believe you should be able to use the Splunk REST API to do that and SHC should replicate the changes as well. See this

0 Karma


Yep, that's what I'll have to use -- updating local.meta was much simpler, however.

0 Karma
Get Updates on the Splunk Community!

About the drill down time range

I want to create a drilldown that searches for the timezone displayed by the Timechart command.<BR />How ...

About Time picker tokens

I would like to search from 600 seconds before to 600 seconds after the time specified in the time picker on ...

tag as datamodel attribute

I'm confused a bit. I use CIM datamodels.The "tag" field is both a filter for choosing events applicable to a ...