How do I change the owner of a saved search?

[aware74]

I don't see any way to do it within the UI, and I'm not sure how to do it on the actual Splunk server.

We are running Splunk 4.3.

Thanks,
Mike

[woodcock]

NEW FEATURE ALERT!

As of Splunk 6.6, you can now do this from the Search Head GUI with the new Reassign Knowledge Objects feature:
https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/ReleaseNotes/NewSplunkCloudFeatures
https://www.splunk.com/blog/2017/05/02/what-s-new-in-splunk-enterprise-6-6-and-splunk-cloud.html

You can also do this from the REST API:
https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API

[gn694]

If you cant restart the Splunk service, it looks like Splunk will automatically reload the meta file info in some (unknown) time interval. I changed the owner for a bunch of saved searches. The changes did not appear in the GUI immediately, and I was not able to restart the Splunk service (doing so would cause a temporary service outage and affect those running searches.) Within half an hour I refreshed the Saved Searches page in my web browserand all of the new owners appeared.

[jbsplunk · Accepted solution]

You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta

If I take this:

[savedsearches/mysearch]
export = none
owner = admin
version = 4.3.1
modtime = 1334164870.793299000

and edit it to this:

[savedsearches/mysearch]
export = none
owner = userx
version = 4.3.1
modtime = 1334164870.793299000

Now 'userx' is the owner, and not admin.

[dglinder]

If you can't restart the splunkd process, calling the URL "http://SplunkServer:8000/en-US/debug/refresh" will force the Splunk process to re-read the meta file information.

[dgavic]

After changing the ownership of a saved search in the local.meta file, and restarting Splunk the ownership of a saved search was changed successfully. Thank you for the great tip.

[piebob]

the only thing i can think of is that maybe you changed the wrong local.metadata file?

[aware74]

I did the same exact thing, restarted the Splunk server, and I'm still the owner of the searches even though I changed the owner to a different account.

Thanks,
Mike

[Giggs]

Tried this but still same result, no owner in gui, do i need to do something else besides doing a restart av splunk?