Reporting

How to delete an Orphaned Scheduled Searches in Cluster Environment

harshal_chakran
Builder

Hi,
I am planning to delete the orphan scheduled search in Splunk Clustered Search Head.

is there any best way to remove it from one Search Head member to see changes in all member.
Probably a Rest API good for this option, however I am not able to find one.

Can anybody guide me for this.

Thanks in advance.

0 Karma

BainM
Communicator

Hi-
I've seen this happen in our cluster master. The best option/way to do this is to go to (on any clustered SH) Settings -> All Configurations -> Reassign Knowledge Objects button.
Change the 'Object Type:All' to 'savedsearches'
Then click the 'Orphaned' button, wait for it to refresh and then you can bulk re-assign or delete any orphaned saved searches.

Warning! Use this tool with care.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...