Reporting

editing a search within an app from the gui

Contributor

Lets say I edit an saved search within an app from the gui as user arnold.
Then the search is owned by arnold in the local.meta and isnt valid anymore in the app. ( cause its private then to arnold.
Is this normal behaviour or do you have to edit searches by configs to avoid conflicts?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

It looks like this is a regression in the latest version of Splunk (4.2). We'll file a bug and address it in an upcoming release.

0 Karma

Contributor

Oke digged into it,,,the suspected searches are within an app and are owned by nobody...so after changing something its owned by the user,,,
So whats best prtatice then? ..change it in the app and modified the permissions initialy before using?

0 Karma

Splunk Employee
Splunk Employee

How are you editing the saved search in question?

Modifying a saved search (e.g. editing its time range) does NOT change its owner.

It is, however, possible to create a private saved search that has the same name as a shared saved search, such that the private and shared saved searches have different owners. Could this be what has happened on your Splunk instance?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!