How do I set the owner on a saved search?

[yazapage]

I need to set the owner and permissions on saved searches after upgrading to 4.1.5 - where can I set these?

[mlf · Accepted solution]

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.