Reporting

How to mass-remove saved searches?

wojtek_swiatek
Path Finder

I have a large number of saved searches I would like to trim down. What is the correct way to do this in 6.x, short of clicking "Delete" in "Searches, reports, and alerts"?

I thought about directly editing savedsearches.conf but I am not sure if this will trigger a clean up of, for instance, metadata.

0 Karma

lguinn2
Legend

You can edit savedsearches.conf - just remove the stanzas for the searches that you want to delete. Then edit the local.meta file in the same app and delete the stanzas related to the same searches.

I would make backups of both files before editing, just in case.

To get Splunk to rescan the files once you have edited them, log in to Splunk as an administrator and then enter the following URI in your browser window: http://yoursplunkhost:8000/debug/refresh (or use https:// if needed)

0 Karma

somesoni2
Revered Legend

Do you have the list of saved searches to be deleted? You can utilize REST API (with curl command) to delete them in batch. See the example on deleting object in below link.

http://dev.splunk.com/view/SP-CAAADQ5

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!