Splunk Search

How do I set the owner on a saved search?

Explorer

I need to set the owner and permissions on saved searches after upgrading to 4.1.5 - where can I set these?

Tags (1)
1 Solution

Path Finder

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.

View solution in original post

Path Finder

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!