Splunk Enterprise Security

Splunk Enterprise Security: How do I Reassign a Splunk ES Correlation Search to a New User?

bradp1234
Path Finder

We have a Splunk ES user who has left and now their correlation searches are orphaned. I am aware of the feature to clone a saved search, but wasn't sure if Splunk ES needed additional steps to ensure the notable and other ES data would be retained with the clone. I tried to clone the correlation search, but this only created a new saved search and not a true correlation search with notable information.

0 Karma
1 Solution

bradp1234
Path Finder

By editing the local.meta file in the various Splunk ES apps (e.g. SA-AuditAndDataProtection) at /opt/splunk/etc/apps/app-name/metadata/local.meta and replacing the disabled owner with the username of an active user, the orphaned searches notification was resolved.

View solution in original post

0 Karma

bradp1234
Path Finder

By editing the local.meta file in the various Splunk ES apps (e.g. SA-AuditAndDataProtection) at /opt/splunk/etc/apps/app-name/metadata/local.meta and replacing the disabled owner with the username of an active user, the orphaned searches notification was resolved.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...