Security

How to copy savedsearches.conf from one user to another?

hartfoml
Motivator

I have a user that use to run reports for his group. he has left the company. Since I am using scripted authentication most of the users profile information does not show up in the management GUI. I can see the savedsearches.conf for for the departed user and I would like to copy the entire saved search into the new employees profile so that they can take over the responsibilities. I am concerned about the VSID number and what it will mean if I copy or don't copy this number into the new employees profile?

Will this cause a problems when I copy the saved search to the new profile?

1 Solution

somesoni2
Revered Legend

You can remove the vsid attribute from savedsearches.conf and move the file to new user's profile. A Splunk refresh (http(s)://splunk_servver:port/en-US/debug/refresh) or restart will be required.

View solution in original post

somesoni2
Revered Legend

You can remove the vsid attribute from savedsearches.conf and move the file to new user's profile. A Splunk refresh (http(s)://splunk_servver:port/en-US/debug/refresh) or restart will be required.

View solution in original post

skender27
Contributor

Hi,

I almost have the same issue.
Does it work (removing the row vsid) also when you copy the savedsearch.conf file from an old Splunk Enterprise to a new one?

Thanks,
Skender

0 Karma

somesoni2
Revered Legend

Yes...!!!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!