Splunk Enterprise Security: How do I Reassign a Splunk ES Correlation Search to a New User?

[bradp1234]

We have a Splunk ES user who has left and now their correlation searches are orphaned. I am aware of the feature to clone a saved search, but wasn't sure if Splunk ES needed additional steps to ensure the notable and other ES data would be retained with the clone. I tried to clone the correlation search, but this only created a new saved search and not a true correlation search with notable information.

[bradp1234 · Accepted solution]

By editing the local.meta file in the various Splunk ES apps (e.g. SA-AuditAndDataProtection) at /opt/splunk/etc/apps/app-name/metadata/local.meta and replacing the disabled owner with the username of an active user, the orphaned searches notification was resolved.