Reporting

How to change the ownership of scheduled searches in Splunk Cloud?

jgorman_THG
Explorer

Hello,

Can someone tell me how I can change the ownership of scheduled searches in Splunk Cloud?

Thanks,

JG

0 Karma

pgreer_splunk
Splunk Employee
Splunk Employee

I don't believe we have a way in the UI to do this, so it most likely will be a request to Splunk Support to do so on your behalf. The process is similar to resolving orphaned searches if a user is removed:

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches

so changing the local metadata and a refresh of splunkd would take care of it. However, changing the local metadata is a CLI thing, which one does not have access to in Splunk Cloud.

NOTE: Resolving orphaned objects is something that will be included in the UI in a near future release.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!