editing a search within an app from the gui

[Starlette]

Lets say I edit an saved search within an app from the gui as user arnold.
Then the search is owned by arnold in the local.meta and isnt valid anymore in the app. ( cause its private then to arnold.
Is this normal behaviour or do you have to edit searches by configs to avoid conflicts?

[ewoo]

It looks like this is a regression in the latest version of Splunk (4.2). We'll file a bug and address it in an upcoming release.

[Starlette]

Oke digged into it,,,the suspected searches are within an app and are owned by nobody...so after changing something its owned by the user,,,
So whats best prtatice then? ..change it in the app and modified the permissions initialy before using?

[ewoo]

How are you editing the saved search in question?

Modifying a saved search (e.g. editing its time range) does NOT change its owner.

It is, however, possible to create a private saved search that has the same name as a shared saved search, such that the private and shared saved searches have different owners. Could this be what has happened on your Splunk instance?