Deployment Architecture

How to change the ownership of an object in a Splunk version 6.x search head cluster?

the_wolverine
Champion

A method previously used with SH Pooling no longer seems to work for search heads in a search head cluster. In the documentation, for changing object ownership, it advises changing the owner of the object, but does not indicate how to do it:

http://docs.splunk.com/Documentation/Splunk/6.2.5/Security/BestpracticeforremovinganLDAPuser

> 3. For any searches or objects that the user owns, change the owner. You
> change it an admin user or maintenance
> account, or whatever you prefer.

(The grammar is also incorrect 🙂

andykanthem
Engager

If you are running version 6.6.x or higher, here is the EASY method:
- On a member of the search head cluster (or your single instance)... Settings-->All Configurations-->Click Reassign Knowledge Objects
- Sort by whatever you need to change (user usually) select the objects taking note of their app association
- Use the checkboxes on the left to select, then click the selected item count above the checkboxes to modify ownership on these objects. Be sure to select ownership which has access to the relevant indexes.

sylim_splunk
Splunk Employee
Splunk Employee

1) You change the ownership for any objects owned by the user on the deployer - manual editing.
Use the same method as stated here;

http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/BestpracticeforremovinganLDAPuser

2) Then move to SHCluster captain, use REST call to change the ownership of objects owned by the user.
Find the REST call below for reference;
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html

You may want to run below as best practice after saved search object ownership have changed so that they are still scheduled correctly.
./splunk _internal call /servicesNS///saved/searches/_reload

This has been improved in 6.6 - we have a GUI, reassign knowledge object you can do this via GUI instead of REST call.

3) Push the bundle from deployer.

0 Karma

somesoni2
Revered Legend

I believe you should be able to use the Splunk REST API to do that and SHC should replicate the changes as well. See this

https://answers.splunk.com/answers/115781/change-the-owner-of-a-saved-search-via-rest.html

0 Karma

the_wolverine
Champion

Yep, that's what I'll have to use -- updating local.meta was much simpler, however.

0 Karma