Knowledge Management

Cleaning up orphaned searches and reports

brent_weaver
Builder

We migrated search heads and there was content in user directories from users that have since quit, and therefore no username got created. I get a message that there are orphaned searched. Any advice?

Tags (1)
0 Karma

maciep
Champion

If you can't use the re-assign objects interface for those searches, then i would suggest either deleting savedsearches.conf from the user ($SPLUNK_HOME/etc/users/the_user/some_app/local/savedsearches.conf) or just delete the user directory all together. If it's shc, you can do that on each member and then a rolling restart.

Of course, first ensure those searches should no longer be running. If they should still be running, then just recreate them yourself.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...