Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- Re: delete owner of scheduled searches
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A user created many searches, and the searches are private. Since these searches belong to the owner, before deleting this user account, i've changed the permission from "Private" to "This App" and assigned to the appropriate roles. However, after doing so, the scheduled searches have stopped running on the scheduled frequency.
Why is it so?
i'm running on Splunk 4.2.5
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to transfer the owner of the saved search to another valid user before deleting the owner's user account. I had to edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta config file that has old owner’s ID and change each occurrence of that to the new ower’s ID. Splunk needs to be restarted for these changes to take effect.
This is a major hidden flaw with Splunk. Because a lot of Splunk administrators do NOT know that before deleting a user and assume that the saved searches will continue to run at the scheduled frequency.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You need to transfer the owner of the saved search to another valid user before deleting the owner's user account. I had to edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta config file that has old owner’s ID and change each occurrence of that to the new ower’s ID. Splunk needs to be restarted for these changes to take effect.
This is a major hidden flaw with Splunk. Because a lot of Splunk administrators do NOT know that before deleting a user and assume that the saved searches will continue to run at the scheduled frequency.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
when you look in splunk/etc/apps/
[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events
Enter the Agentic Era with Splunk AI Assistant for SPL 1.4
Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...
