I know the rest api command to change the ownership of a saved search. Below is the command. I want to know corresponding SPL so that I can issue this query from Splunk web interface and change the ownership.
/servicesNS/user01/search/saved/searches/$_SAVED_SEARCH_NAME_$/acl -d owner=user02 -d sharing=$_SHARING_VALUE_$
Can anyone please help me here?
You can't use SPL command rest to change ownership because with that command you can only fire GET request, not POST request.
To change ownership of schedule search POST request is require, you can achieve it using https://splunkbase.splunk.com/app/4146/ or if you are CLI fan then have a look at https://github.com/harsmarvania57/splunk-ko-change
View solution in original post
Thank you for the clarification and the links.