Security
Highlighted

How to copy savedsearches.conf from one user to another?

Motivator

I have a user that use to run reports for his group. he has left the company. Since I am using scripted authentication most of the users profile information does not show up in the management GUI. I can see the savedsearches.conf for for the departed user and I would like to copy the entire saved search into the new employees profile so that they can take over the responsibilities. I am concerned about the VSID number and what it will mean if I copy or don't copy this number into the new employees profile?

Will this cause a problems when I copy the saved search to the new profile?

Highlighted

Re: How to copy savedsearches.conf from one user to another?

SplunkTrust
SplunkTrust

You can remove the vsid attribute from savedsearches.conf and move the file to new user's profile. A Splunk refresh (http(s)://splunk_servver:port/en-US/debug/refresh) or restart will be required.

View solution in original post

Highlighted

Re: How to copy savedsearches.conf from one user to another?

Contributor

Hi,

I almost have the same issue.
Does it work (removing the row vsid) also when you copy the savedsearch.conf file from an old Splunk Enterprise to a new one?

Thanks,
Skender

0 Karma
Highlighted

Re: How to copy savedsearches.conf from one user to another?

SplunkTrust
SplunkTrust

Yes...!!!!

0 Karma