Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: How do I change the owner of alerts in splunk ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Dears,
I have around 100 alerts configured in splunk with one AD user.
Since this AD user is left the organization, I need to change the ownership of all alerts under his name to my name.
Is this possible in splunk. I couldn't find any docs as such for this.
Tried looking at savedsearch.conf under the app but there is nothing like owner filed in any alert.
Thanks,
Ramu Chittiprolu
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are on a new enough version of Splunk, there's now UI pieces that cover this use case exactly. Relevant Docs: http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Resolveorphanedsearches#Bulk-reassign_mu...
If not, the REST API has a method of updating the ACLs of a knowledge object: https://docs.splunk.com/Documentation/Splunk/7.1.1/RESTUM/RESTusing#Access_Control_List
Otherwise you're looking inside of metadata directories inside of apps and the system dir for default.meta and/or local.meta files and changing those then restarting: http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/defaultmetaconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are on a new enough version of Splunk, there's now UI pieces that cover this use case exactly. Relevant Docs: http://docs.splunk.com/Documentation/Splunk/7.1.1/Knowledge/Resolveorphanedsearches#Bulk-reassign_mu...
If not, the REST API has a method of updating the ACLs of a knowledge object: https://docs.splunk.com/Documentation/Splunk/7.1.1/RESTUM/RESTusing#Access_Control_List
Otherwise you're looking inside of metadata directories inside of apps and the system dir for default.meta and/or local.meta files and changing those then restarting: http://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/defaultmetaconf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
My splunk version is 6.6.3.
Does the above documentation applicable ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
es, I did it myself, and I am currently running SPLUNK version 8.0.4.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It appears so. Merely change the text 7.1.1 in the URL, or toggle the Version drop down on the top of the page (upper right) to validate for the given version you are using. Enjoy!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. It worked flawlessly.
Data Management Digest – December 2025
Index This | What is broken 80% of the time by February?
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
