Reporting

How do I change the owner of a saved search?

aware74
Explorer

I don't see any way to do it within the UI, and I'm not sure how to do it on the actual Splunk server.

We are running Splunk 4.3.

Thanks,
Mike

Tags (2)
1 Solution

jbsplunk
Splunk Employee
Splunk Employee

You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta

If I take this:

[savedsearches/mysearch]
export = none
owner = admin
version = 4.3.1
modtime = 1334164870.793299000

and edit it to this:

[savedsearches/mysearch]
export = none
owner = userx
version = 4.3.1
modtime = 1334164870.793299000

Now 'userx' is the owner, and not admin.

View solution in original post

woodcock
Esteemed Legend

gn694
Communicator

If you cant restart the Splunk service, it looks like Splunk will automatically reload the meta file info in some (unknown) time interval. I changed the owner for a bunch of saved searches. The changes did not appear in the GUI immediately, and I was not able to restart the Splunk service (doing so would cause a temporary service outage and affect those running searches.) Within half an hour I refreshed the Saved Searches page in my web browserand all of the new owners appeared.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta

If I take this:

[savedsearches/mysearch]
export = none
owner = admin
version = 4.3.1
modtime = 1334164870.793299000

and edit it to this:

[savedsearches/mysearch]
export = none
owner = userx
version = 4.3.1
modtime = 1334164870.793299000

Now 'userx' is the owner, and not admin.

dglinder
Path Finder

If you can't restart the splunkd process, calling the URL "http://SplunkServer:8000/en-US/debug/refresh" will force the Splunk process to re-read the meta file information.

dgavic
Explorer

After changing the ownership of a saved search in the local.meta file, and restarting Splunk the ownership of a saved search was changed successfully. Thank you for the great tip.

0 Karma

piebob
Motivator

the only thing i can think of is that maybe you changed the wrong local.metadata file?

0 Karma

aware74
Explorer

I did the same exact thing, restarted the Splunk server, and I'm still the owner of the searches even though I changed the owner to a different account.

Thanks,
Mike

0 Karma

Giggs
New Member

Tried this but still same result, no owner in gui, do i need to do something else besides doing a restart av splunk?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...