Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to disable all searches for a user?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a user that is no longer here, however all saved searches are still trying to run.
This causes a lot of "Failed to get LDAP" errors, and I assume is part of a performance issue I am seeing.
Since, there are not other members of this users team complaining that these searches are not firing, I want to just disable them, but not completely remove yet.
Can this be done in bulk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A good feature would be to be able to enable/disable everything owned by a user.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@GeorgeStarkey - agreed! And you can make a formal enhancement request here:
http://www.splunk.com/index.php/submit_issue
Enter it just like a support ticket, but choose the "enhancement" option.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. But my question is how to do this in bulk. This user has many searches. And this will not be a once only problem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no way to do this in bulk from the Splunk UI.
It is not trivial to write a script for this, as you need to examine savedsearches.conf and the corresponding local.meta files over all the apps as well as the user's private directories.
.conf25 Global Broadcast: Don’t Miss a Moment
Observe and Secure All Apps with Splunk
What's New in Splunk Observability - August 2025
