Reporting

What's the best solution for orphaned searches?

twinspop
Influencer

2 problems:

1) There is no change ownership option in the GUI - seems like a huge oversight.

2) The search to show orphaned searches times out with no results.

So I'm left with not being able to proactively identify the OSs, and when users come to me about missing scheduled searches, I have no easy solution for fixing them aside from climbing through savedsearches.conf files manually.

Any recommendations? With a user count rapidly approaching 10k, and the normal churn at Big American Corp(tm), this is turning into a big thorn in my side.

1 Solution

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

View solution in original post

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

jkat54
SplunkTrust
SplunkTrust

In 6.6.x there is ability to change ownership via GUI:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches

Previous versions you'll need to use this method instead:
http://docs.splunk.com/Documentation/Splunk/6.5.4/Knowledge/Resolveorphanedsearches

0 Karma

aferone
Builder

Open a case. I have the same problem, and Splunk Support is pretty sure this is a bug. I am running 6.4.2.

0 Karma

twinspop
Influencer

Method I used for the case reported today: On the CLI, I used sed (or perl, or whatever) to globally replace the old username in local.meta with a new, existing, username. Unfortunately, on an SHC this is messy as the changes need to be sync'd with all SHC members, and then restarted. Does it work? Yes. Is it gross/clumsy/error-prone? Also also yes.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...