Splunk Search

How to do you change ownership of a lookup file?


We have several lookup files for users who have left, and we would like to transfer the ownership to a new production user that we have created for the purpose. Any idea how to do this?

For other knowledge objects this can be done in settings > All Configurations > Reassign Knowledge Objects, but lookups do not seem to be included in this list.

Splunk 6.6.5
ES: 4.7.4

0 Karma


You'll have to move the files manually from $SPLUNK_HOME/etc/users/<olduser>/<app>/lookups/* to $SPLUNK_HOME/etc/users/<newuser>/lookups.

If this reply helps you, Karma would be appreciated.

New Member

In addition to the above, please also look at the following link as the instructions there solved my ownership issue:


In some cases the file is stored under the app context and moving it won't change the ownership. This happened to me while updating a lookup file for a custom app. There is a metadata folder in the app folder which contains default and local .meta files. I edited the local.meta file, found my owner=[myuseraccount] and changed this to nobody (or whatever user you want). Found the metadata files under $SPLUNK_HOME$/etc/apps/[appname]/metadata.

0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...