How to mass-remove saved searches?

Path Finder

I have a large number of saved searches I would like to trim down. What is the correct way to do this in 6.x, short of clicking "Delete" in "Searches, reports, and alerts"?

I thought about directly editing savedsearches.conf but I am not sure if this will trigger a clean up of, for instance, metadata.

0 Karma


You can edit savedsearches.conf - just remove the stanzas for the searches that you want to delete. Then edit the local.meta file in the same app and delete the stanzas related to the same searches.

I would make backups of both files before editing, just in case.

To get Splunk to rescan the files once you have edited them, log in to Splunk as an administrator and then enter the following URI in your browser window: http://yoursplunkhost:8000/debug/refresh (or use https:// if needed)

0 Karma

Revered Legend

Do you have the list of saved searches to be deleted? You can utilize REST API (with curl command) to delete them in batch. See the example on deleting object in below link.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...