Splunk Search

How to Disable Orphaned Searches?

kmower
Communicator

I have read through the Splunk documentation, but I cannot find a way to disable an orphaned scheduled search. There is information on how to reassign an orphaned Search to a new owner - https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Resolveorphanedsearches - but no real information on disabling an Orphaned Search - https://docs.splunk.com/Documentation/Splunk/7.2.6/Knowledge/Disableordeleteknowledgeobjects

I just want to disable the orphaned searches for now (in the Splunk app for Windows Infrastructure) so they don't run and throw warnings. I don't mind jumping into the config files, I just need some solid info on how to disable an orphaned search. I am Admin over my On Prem Splunk Enterprise, and there is no GUI control to 'disable' although there is a 'status' column with 'enabled'. There is also an 'is_scheduled' column/flag which I could change to 0 ... thanks.

Tags (1)
0 Karma
1 Solution

kmower
Communicator

Right, well, I guess I answered this one myself. There is no GUI to disable saved searches.

Instead I went into savedsearches.conf and changed all of the orphaned searches in my warnings to disabled = 1. Restarted Splunk.

View solution in original post

kmower
Communicator

Right, well, I guess I answered this one myself. There is no GUI to disable saved searches.

Instead I went into savedsearches.conf and changed all of the orphaned searches in my warnings to disabled = 1. Restarted Splunk.

pruthvikrishnap
Contributor

Yeah that would be the simplest way to disable them for now.
if you are on a search head cluster you will have to do it on all the members and then to a rolling restart for these changes to get effected.

Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...