Splunk Search

Saved Search Owner Gone

ironhalo
Explorer

If the user who owns a saved search is locked our or deleted, what will become of their saved searches? Do I need to modify the local.meta file, or will the jobs simply become orphaned? If they become orphaned, will they still run?

Tags (3)

lguinn2
Legend

If you delete a user, the PRIVATE saved searches owned by the user will be deleted. If the user has SHARED any searches (or other knowledge objects), they will still exist.

The shared knowledge objects will still have the deleted user's name attached to them; they may be deleted by the Splunk admin. However, I don't think there is any mechanism for the Splunk admin to assign the saved searches to another user.

tweaktubbie
Communicator

Would be handy if reassign was implemented; in 6.4 orphaned searches are brought to your attention, but the only solution to make it work again is clone to something renamed, remove the original search, and clone to the original name again (and remove the temp clone).

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

For those of you on *Nix machines would be able to do something like this:
cd $SPLUNK_HOME/etc
for x in find . -name 'local.meta'; do cp $x $x.old ; sed s/olduser/newuser/ < $x > $x.new ; mv -f $x.new $x ; done
This will make a backup of the local.meta, swap out the olduser for the newuser and copy it over the local.meta. All you should have to do is restart Splunk.
Brian

lguinn2
Legend

Although you could do this:

Determine the app that the savedsearch (or tag or eventtype etc) belongs to. Edit the file
$SPLUNK_HOME/etc/apps/[appname]/metadata/local.meta

Find the item(s) that need to be changed, and update the owner field.

This should change the owner. AFAIK, there is no way to do this from the GUI.

0 Karma

Takajian
Builder

If you delete user, the saved search owned by the user will be deleted. Configuration owned by user is stored in $SPLUNK_HOME/etc/user directory. If you remove the user completely, those configuration will be also removed.

0 Karma

woodcock
Esteemed Legend

Only those searches that have Private permissions; the ones with App or Global are located elsewhere and will not be deleted but will switch to ownership of nobody.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...