Reporting

What's the best solution for orphaned searches?

twinspop
Influencer

2 problems:

1) There is no change ownership option in the GUI - seems like a huge oversight.

2) The search to show orphaned searches times out with no results.

So I'm left with not being able to proactively identify the OSs, and when users come to me about missing scheduled searches, I have no easy solution for fixing them aside from climbing through savedsearches.conf files manually.

Any recommendations? With a user count rapidly approaching 10k, and the normal churn at Big American Corp(tm), this is turning into a big thorn in my side.

1 Solution

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

View solution in original post

twinspop
Influencer

With 6.5.3 and above the orphaned report works. So progress! My current workflow is

1) add the owner back to splunk temporarily
2) use the REST API to change ownership from the old owner to a new (existing) user
3) delete the owner from the system

Example API access to change ownership with curl (including disabling the search):

curl -ku admin https://searchhead:8089/servicesNS/olduser/appname/saved/searches/searchname/acl -d owner=newowner -d disabled=1

jkat54
SplunkTrust
SplunkTrust

In 6.6.x there is ability to change ownership via GUI:
http://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Resolveorphanedsearches

Previous versions you'll need to use this method instead:
http://docs.splunk.com/Documentation/Splunk/6.5.4/Knowledge/Resolveorphanedsearches

0 Karma

aferone
Builder

Open a case. I have the same problem, and Splunk Support is pretty sure this is a bug. I am running 6.4.2.

0 Karma

twinspop
Influencer

Method I used for the case reported today: On the CLI, I used sed (or perl, or whatever) to globally replace the old username in local.meta with a new, existing, username. Unfortunately, on an SHC this is messy as the changes need to be sync'd with all SHC members, and then restarted. Does it work? Yes. Is it gross/clumsy/error-prone? Also also yes.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...