We have a user that is no longer here, however all saved searches are still trying to run.
This causes a lot of "Failed to get LDAP" errors, and I assume is part of a performance issue I am seeing.
Since, there are not other members of this users team complaining that these searches are not firing, I want to just disable them, but not completely remove yet.
Can this be done in bulk?
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
A good feature would be to be able to enable/disable everything owned by a user.
@GeorgeStarkey - agreed! And you can make a formal enhancement request here:
http://www.splunk.com/index.php/submit_issue
Enter it just like a support ticket, but choose the "enhancement" option.
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
Yes. But my question is how to do this in bulk. This user has many searches. And this will not be a once only problem.
There is no way to do this in bulk from the Splunk UI.
It is not trivial to write a script for this, as you need to examine savedsearches.conf and the corresponding local.meta files over all the apps as well as the user's private directories.