Reporting

How do you change the ownership of saved reports in 6.5.2?

jkrehrer22
Engager

Hi All,

I need to change ownership of some saved reports to a different user. I completed the following on our three search heads (distributed):

  1. splunkhome/etc/apps/search/metadata vi local.meta
  2. searched and replaced the user with the new user
  3. Did this to all three search heads
  4. https://xxxxxxx.com:8000/en-us/refresh/debug
  5. Refreshed

I am still seeing the same owner when looking at the saved searches on the web. I did NOT restart the search heads as all the documentation I visited said that I did not need to do this.

We are running a distributed enterprise environment at version 6.5.2.

What else do I need to do?

Thank you for any help.

0 Karma

gjanders
SplunkTrust
SplunkTrust

You can use the REST API to change the ownership, I recently did a server to server migration and created a script for this transfersplunkknowledgeobjects.py

The script won't work for what you are trying to do but the endpoints are relevant, however if you only goal is to reown the items to a new user try the reownItems script I have or just call the REST endpoints listed...

Rob2520
Communicator

@jkrehrer22 The easy process that i follow is ...via UI go to settings --> All configuration --> choose your App --> Click on reassign knowledge objects --> choose the alerts and reassign to new owner. This process doesn't need any restart. Apply the same on other search heads.

jkrehrer22
Engager

Hey, thanks for the reply.

I don't know if it's because I'm running version 6.5.2, but I don't see "reassign knowledge objects" from all configurations --> my saved searches.

0 Karma

gjanders
SplunkTrust
SplunkTrust

This is not available in 6.5.x, I believe that might have been a 6.6 feature

0 Karma

sir_lamneth
Explorer

I don't see the default.meta or local.meta that is called out here on files that don't need a restart:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Configurationfilechangesthatrequirerestart

When I made an ownership change to local.meta, it went into effect after a restart. Is there a specific reason you didn't restart? You mention being in a distributed environment — does that mean search head cluster? Are your SH apps being managed using a Deployment Server? If so, then you shouldn't manually edit the config files on each individual SH, but rather let your deployment process control the change application (Deployer pushing things for SH Cluster, or the SH getting its new config from a Deployment Server).

jkrehrer22
Engager

Hey, thanks for your reply!

So, I noticed today that the owners did change when I manually edited the file locally. (took some time to refresh, I guess). You make a good point about pushing configuration files from a deployer or Deployment Server.

That being said, how would I be able to push this configuration file from the deployer to our clustered search heads? My idea would be to copy local.meta from one of the search heads and place it inside the same path within the deployer. Then just push the configurations? The deployer is already connected to our SH cluster.

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...