Solved: How do I set the owner on a saved search?

yazapage · ‎01-25-2011

I need to set the owner and permissions on saved searches after upgrading to 4.1.5 - where can I set these?

mlf · ‎02-23-2011

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.

View solution in original post

mlf · ‎02-23-2011

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.

How do I set the owner on a saved search?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation