Splunk Search

Re-assigning or deleting the orphaned searches

splunkgk
Path Finder

What is the best way to delete or re-assign the orphaned searches?. I have around more than 100 orphaned searches which i need to re-assign them to someone other users. I read this can be done be deleting the searches directly from limits.meta file But i am not sure which is the exact file file i can use for this.

Tags (1)
0 Karma

viewpost_rgora
Explorer

You can search through the local.meta files and re-assign the orphaned searches to a user that still exists.

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Resolveorphanedsearches

0 Karma

dhruv05
New Member

For deleting OR re-owning the scheduled-search or view

  • Go the app [/etc/apps//local/metadata/local.meta]
  • Either delete the search or re-own the scheduled-search using a service a/c
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...