Is there some way to call saved searches via loadjob WITHOUT specifying the username/owner?

[jamesvz84]

There are some saved searches that are used in our organization and called via "loadjob". The problem is, that the creator/owner of these saved searches will soon be leaving our group and so we are looking to delete his username.

Is there some way to call saved searches via loadjob WITHOUT referencing the username? I can imagine this happening again and us having to once again re-assign the user just to make the searches work. It would be better if the searches just kept working without intervention.

[vasanthmss]

Hi James,

May be whenever you are delivering / after testing, manually you can move all the search to no owner / admin in the local.metadata file. Its one time activity. after changing you can use either admin / nobody based on your configuration.

$Splunk_Home$/etc/apps/<appname>/metadata/local.metadata

So don't worry about the user name, always the loadjob will work. 🙂

Cheers!