Reporting

Cannot find user ID with id=-1

wwhitener
Communicator

I am documenting an upgrade and get the following error messages for my saved searches:

could not find user in splunk etc/passwd corresponding to id=-1 from savedsearch: TEST_SAVED_SEARCH ... simply using as is for meta

I've tried manually putting in -1 into the passwd file. I've tried to hunt down the saved search file and nothing appears to be working. I'd like to continue the upgrade, but I can't afford to lose the numerous saved searches and data.

Any ideas?

Thanks.

0 Karma
1 Solution

wwhitener
Communicator

OK. The answer was pretty simple.

Open up the saved search file at /opt/splunk/etc/system/local and change the userid from -1 to 1.

I'd guess it was because I created them using the free version?

View solution in original post

0 Karma

wwhitener
Communicator

OK. The answer was pretty simple.

Open up the saved search file at /opt/splunk/etc/system/local and change the userid from -1 to 1.

I'd guess it was because I created them using the free version?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...