Deployment Architecture

How to change the ownership of an object in a Splunk version 6.x search head cluster?

Champion

A method previously used with SH Pooling no longer seems to work for search heads in a search head cluster. In the documentation, for changing object ownership, it advises changing the owner of the object, but does not indicate how to do it:

http://docs.splunk.com/Documentation/Splunk/6.2.5/Security/BestpracticeforremovinganLDAPuser

> 3. For any searches or objects that the user owns, change the owner. You
> change it an admin user or maintenance
> account, or whatever you prefer.

(The grammar is also incorrect 🙂

Engager

If you are running version 6.6.x or higher, here is the EASY method:
- On a member of the search head cluster (or your single instance)... Settings-->All Configurations-->Click Reassign Knowledge Objects
- Sort by whatever you need to change (user usually) select the objects taking note of their app association
- Use the checkboxes on the left to select, then click the selected item count above the checkboxes to modify ownership on these objects. Be sure to select ownership which has access to the relevant indexes.

Splunk Employee
Splunk Employee

1) You change the ownership for any objects owned by the user on the deployer - manual editing.
Use the same method as stated here;

http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/BestpracticeforremovinganLDAPuser

2) Then move to SHCluster captain, use REST call to change the ownership of objects owned by the user.
Find the REST call below for reference;
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html

You may want to run below as best practice after saved search object ownership have changed so that they are still scheduled correctly.
./splunk _internal call /servicesNS///saved/searches/_reload

This has been improved in 6.6 - we have a GUI, reassign knowledge object you can do this via GUI instead of REST call.

3) Push the bundle from deployer.

0 Karma

Revered Legend

I believe you should be able to use the Splunk REST API to do that and SHC should replicate the changes as well. See this

https://answers.splunk.com/answers/115781/change-the-owner-of-a-saved-search-via-rest.html

0 Karma

Champion

Yep, that's what I'll have to use -- updating local.meta was much simpler, however.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!