Reporting

What's the best solution for orphaned searches?

twinspop
Influencer

2 problems:

1) There is no change ownership option in the GUI - seems like a huge oversight.

2) The search to show orphaned searches times out with no results.

So I'm left with not being able to proactively identify the OSs, and when users come to me about missing scheduled searches, I have no easy solution for fixing them aside from climbing through savedsearches.conf files manually.

Any recommendations? With a user count rapidly approaching 10k, and the normal churn at Big American Corp(tm), this is turning into a big thorn in my side.

1 Solution

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

View solution in original post

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

View solution in original post

jkat54
SplunkTrust
SplunkTrust

In 6.6.x there is ability to change ownership via GUI:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches

Previous versions you'll need to use this method instead:
http://docs.splunk.com/Documentation/Splunk/6.5.4/Knowledge/Resolveorphanedsearches

0 Karma

aferone
Builder

Open a case. I have the same problem, and Splunk Support is pretty sure this is a bug. I am running 6.4.2.

0 Karma

benlc
Path Finder
0 Karma

twinspop
Influencer

Method I used for the case reported today: On the CLI, I used sed (or perl, or whatever) to globally replace the old username in local.meta with a new, existing, username. Unfortunately, on an SHC this is messy as the changes need to be sync'd with all SHC members, and then restarted. Does it work? Yes. Is it gross/clumsy/error-prone? Also also yes.

0 Karma

Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on