Hello guys,
We have some orphaned saves searches in our splunk cloud instance that are viewable via the following Rest search:
| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
However when looking at the searches pulled in searches > Reports and Alerting they do not show up.
There are also zero saved searches viewable under Settings > All Configurations > Reassign Knowledge Objects > Orphaned (with all filters on all)
We are trying to reassign these searches via Rest with the following example syntax:
curl -sk -H 'Authorization: Bearer <token>' -d 'owner=<name of valid owner>' https://<splunk cloud.com>:8089/servicesNS/nobody/search/saved/searches/%28%20Customers-LoyaltyEnrollment_1.0%20%29
But are receiving the following error
This is not an issue with the id as the following is able to pull saved search info.
curl -sk -H 'Authorization: Bearer <token>' https://<splunk cloud.com>:8089/servicesNS/nobody/search/saved/searches/%28%20Customers-LoyaltyEnrollment_1.0%20%29
Does anyone have a better syntax to use to post this owner change to the saved searches?
