Security

Cannot delete saved searches of a user that no longer exists?

vhallan_splunk
Splunk Employee
Splunk Employee

An ex-colleague user has been removed from access controls however their saved searches linked with his username are still running and i am seeing errors of orphaned searches. I am an Admin but cannot delete these searches. Is there another way?

Tags (1)

cmerriman
Super Champion

There are a couple of ways you can resolve this issue. If you wish to delete/disable/unschedule the orphaned searches, you can do so under Settings>Searches, reports, and alerts or delete it from the Reports listing page.

You can reassign the search in savedsearches.conf by cutting the stanza out from the invalid user and pasting under a valid user and restart your instance.

http://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches#Delete_an_orphan...

vhallan_splunk
Splunk Employee
Splunk Employee

That would work, however I am a cloud customer so do not have access via command line 😞 but good answer!

cmerriman
Super Champion

http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Admintasks

Editing and .conf directly in Splunk Cloud requires a Support Ticket with Splunk Support.

http://docs.splunk.com/Documentation/SplunkCloud/6.5.0/User/Useraccounts

You can change user account settings, such as the password as @arowsell has mentioned, and remove the searches. After doing that you can delete the user account.

horsefez
Motivator

Hello vhallan,

there is the possiblity of you deleting the searches by editing the .conf files directly.
You can go under your Splunk-Home-Directory -> /etc/apps/search/local/ and edit savedsearches.conf there.
Just delete savedsearches that are not needed anymore.

Then go into the Splunk-Home-Directory and under /etc/apps/search/metadata/local/ where you need to delete the
[savedsearches/Nameofthesavedsearch]
Stanza with all it's parameters.

I did this myself this way, when I ran into the problem before.
No guarantee that this is the perfect solution.

Regards,
pyro_wood

arowsell_splunk
Splunk Employee
Splunk Employee

Hi, the easiest way as a Splunk Admin would be to re-created the user account of the ex-colleague with a different password. When you login as this user you should be able to see all their saved searches etc and have the ability to delete them.

You could also probably delete them through the CLI.

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...