Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to disable all searches for a user?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We have a user that is no longer here, however all saved searches are still trying to run.
This causes a lot of "Failed to get LDAP" errors, and I assume is part of a performance issue I am seeing.
Since, there are not other members of this users team complaining that these searches are not firing, I want to just disable them, but not completely remove yet.
Can this be done in bulk?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A good feature would be to be able to enable/disable everything owned by a user.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@GeorgeStarkey - agreed! And you can make a formal enhancement request here:
http://www.splunk.com/index.php/submit_issue
Enter it just like a support ticket, but choose the "enhancement" option.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you are the admin, you can go to Settings -> Searches, reports, and alerts and then choose the user from the Owner drop-down. Click "Disable" for each of the searches. That should do it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. But my question is how to do this in bulk. This user has many searches. And this will not be a once only problem.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is no way to do this in bulk from the Splunk UI.
It is not trivial to write a script for this, as you need to examine savedsearches.conf and the corresponding local.meta files over all the apps as well as the user's private directories.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
