serches not displayed after upgrade to 6.0

[wojtek_swiatek]

Hello,

We have just upgraded a splunk instance to 6.0 and the searches which worked previously now display:

In handler 'savedsearch': User
'nobody' could not act as: r4o

The user r4o was the creator of the search, he left some time ago (when we were still on 5.x). The users are handled though a connection to AD (where r4o is not present anymore).

I assume the issue comes from there (?)

• is there a way to allow user 'nobody' to run the searches anyway
• OR can we change in a batch the ownership of the searches to a known user
• OR can we change the rights so that anyone (including 'nobody' who apparently acts on behalf of 'r4o') can run the searches?

Thank you!

[davidpaper]

After upgrading from 5.x to 6.1.2 yesterday, I now see this problem too.

Did you find an answer to this problem?

[davidpaper]

Ah, I did figure out how to fix this! In the app that owns the saved search, look for the $app/metadata/local.meta file. In that file, look for the name of the saved search. There is a field called "owner" that has the old AD or LDAP userid in it. Replace that old userid with "nobody" (no quotes). This is a userid that Splunk sets aside to be able to run saved searches when there is no real userid that owns the search anymore.

Restart the search head after the change, or run $SPLUNK/bin/splunk btool fix-dangling and wait a few seconds and reload the dashboard.

[wojtek_swiatek]

Unfortunately not. We ended up recreating the searches and graphs.

[simonmaas]

Hello wojtek.swiatek,

does it mean the VMware app won't be updated at all or just the searches and graphs?

Thanks!