I believe I have found a possible bug. There is a condition that when you delete a saved search all saved searches with the same name will be deleted. I have discovered this in both 4.3 and 5.0.
Steps to reproduce:
- Create a new user 'test'
- Create a saved search called 'test search'
- Change permissions to "App", "Everyone can read"
- Login as another user, like admin
- Clone the saved search and use the same name ("test search")
- Delete the original search created/owned by 'test' user
- Both searches will be deleted
We have experience this multiple times. How do I file a proper bug report with Splunk?
