How to delete an Orphaned Scheduled Searches in Cluster Environment

[harshal_chakran]

Hi,
I am planning to delete the orphan scheduled search in Splunk Clustered Search Head.

is there any best way to remove it from one Search Head member to see changes in all member.
Probably a Rest API good for this option, however I am not able to find one.

Can anybody guide me for this.

Thanks in advance.

[BainM]

Hi-
I've seen this happen in our cluster master. The best option/way to do this is to go to (on any clustered SH) Settings -> All Configurations -> Reassign Knowledge Objects button.
Change the 'Object Type:All' to 'savedsearches'
Then click the 'Orphaned' button, wait for it to refresh and then you can bulk re-assign or delete any orphaned saved searches.

Warning! Use this tool with care.