I don't see any way to do it within the UI, and I'm not sure how to do it on the actual Splunk server.
We are running Splunk 4.3.
Thanks,
Mike
You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta
If I take this:
[savedsearches/mysearch]
export = none
owner = admin
version = 4.3.1
modtime = 1334164870.793299000
and edit it to this:
[savedsearches/mysearch]
export = none
owner = userx
version = 4.3.1
modtime = 1334164870.793299000
Now 'userx' is the owner, and not admin.
NEW FEATURE ALERT!
As of Splunk 6.6, you can now do this from the Search Head GUI with the new Reassign Knowledge Objects
feature:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/ReleaseNotes/NewSplunkCloudFeatures
https://www.splunk.com/blog/2017/05/02/what-s-new-in-splunk-enterprise-6-6-and-splunk-cloud.html
You can also do this from the REST API:
https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API
If you cant restart the Splunk service, it looks like Splunk will automatically reload the meta file info in some (unknown) time interval. I changed the owner for a bunch of saved searches. The changes did not appear in the GUI immediately, and I was not able to restart the Splunk service (doing so would cause a temporary service outage and affect those running searches.) Within half an hour I refreshed the Saved Searches page in my web browserand all of the new owners appeared.
You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta
If I take this:
[savedsearches/mysearch]
export = none
owner = admin
version = 4.3.1
modtime = 1334164870.793299000
and edit it to this:
[savedsearches/mysearch]
export = none
owner = userx
version = 4.3.1
modtime = 1334164870.793299000
Now 'userx' is the owner, and not admin.
If you can't restart the splunkd process, calling the URL "http://SplunkServer:8000/en-US/debug/refresh" will force the Splunk process to re-read the meta file information.
After changing the ownership of a saved search in the local.meta file, and restarting Splunk the ownership of a saved search was changed successfully. Thank you for the great tip.
the only thing i can think of is that maybe you changed the wrong local.metadata file?
I did the same exact thing, restarted the Splunk server, and I'm still the owner of the searches even though I changed the owner to a different account.
Thanks,
Mike
Tried this but still same result, no owner in gui, do i need to do something else besides doing a restart av splunk?