How to mass-remove saved searches?

[wojtek_swiatek]

I have a large number of saved searches I would like to trim down. What is the correct way to do this in 6.x, short of clicking "Delete" in "Searches, reports, and alerts"?

I thought about directly editing savedsearches.conf but I am not sure if this will trigger a clean up of, for instance, metadata.

[lguinn2]

You can edit savedsearches.conf - just remove the stanzas for the searches that you want to delete. Then edit the local.meta file in the same app and delete the stanzas related to the same searches.

I would make backups of both files before editing, just in case.

To get Splunk to rescan the files once you have edited them, log in to Splunk as an administrator and then enter the following URI in your browser window: http://yoursplunkhost:8000/debug/refresh (or use https:// if needed)

[somesoni2]

Do you have the list of saved searches to be deleted? You can utilize REST API (with curl command) to delete them in batch. See the example on deleting object in below link.

http://dev.splunk.com/view/SP-CAAADQ5