How to delete an Orphaned Scheduled Searches in Cluster Environment


I am planning to delete the orphan scheduled search in Splunk Clustered Search Head.

is there any best way to remove it from one Search Head member to see changes in all member.
Probably a Rest API good for this option, however I am not able to find one.

Can anybody guide me for this.

Thanks in advance.

0 Karma


I've seen this happen in our cluster master. The best option/way to do this is to go to (on any clustered SH) Settings -> All Configurations -> Reassign Knowledge Objects button.
Change the 'Object Type:All' to 'savedsearches'
Then click the 'Orphaned' button, wait for it to refresh and then you can bulk re-assign or delete any orphaned saved searches.

Warning! Use this tool with care.

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...