when you delete a user, do things OTHER THAN saved searches need to be "re-owned"?

[matthewarguin]

our splunk deployment utilizes LDAP for auth. as such, most of our users are ldap users. One of our team members recently departed and we ended up with orphaned saved searches, which i changed the owner ship to a role acct in our ldap so that they do not get orphaned in the future. When in the local.meta file, i noted that there were a pile of other items owned by the departed user. They are multiples of:

datamodels
indexes
inputs
models
props
views

do these need to be changed as well? if so, i assume the same process as the saved searches, edit the local.meta ,then hit the button on the debug refresh link?

[lguinn2 · Accepted solution]

Yes, a user can own all sorts of "knowledge objects," and all of them need to be updated if you want them to be available in the future.
Your process will work just fine. In addition to the items that you have listed, I would also check for lookups and field extractions (less likely) that were owned by this user.

You could simply search all the local.meta files for the name of the departed user, to make sure you aren't missing something.