Splunk Search
Highlighted

How do I set the owner on a saved search?

Explorer

I need to set the owner and permissions on saved searches after upgrading to 4.1.5 - where can I set these?

Tags (1)
Highlighted

Re: How do I set the owner on a saved search?

Path Finder

You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.

For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.

View solution in original post