What's the best solution for orphaned searches?

[twinspop]

2 problems:

1) There is no change ownership option in the GUI - seems like a huge oversight.

2) The search to show orphaned searches times out with no results.

So I'm left with not being able to proactively identify the OSs, and when users come to me about missing scheduled searches, I have no easy solution for fixing them aside from climbing through savedsearches.conf files manually.

Any recommendations? With a user count rapidly approaching 10k, and the normal churn at Big American Corp(tm), this is turning into a big thorn in my side.

[twinspop · Accepted solution]

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

[jkat54]

In 6.6.x there is ability to change ownership via GUI:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches

Previous versions you'll need to use this method instead:
http://docs.splunk.com/Documentation/Splunk/6.5.4/Knowledge/Resolveorphanedsearches

[aferone]

Open a case. I have the same problem, and Splunk Support is pretty sure this is a bug. I am running 6.4.2.

[benlc]

https://docs.splunk.com/Documentation/Splunk/6.4.3/Knowledge/Resolveorphanedsearches

[twinspop]

Method I used for the case reported today: On the CLI, I used sed (or perl, or whatever) to globally replace the old username in local.meta with a new, existing, username. Unfortunately, on an SHC this is messy as the changes need to be sync'd with all SHC members, and then restarted. Does it work? Yes. Is it gross/clumsy/error-prone? Also also yes.