The debug/refresh trick doesn't seem to work for <app>/local/savedsearch.conf deletions. At least not for me on 8.1.1. ... View more

If Splunk's official response to this is 'use setfacl' and not "we should be obeying the umask set for the user Splunk runs as", that's pretty awful from a system administrators point of view. ... View more