This currently can't be done via the Splunk UI, however via REST this action can be done and scripted. Following https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API you can edit any knowledge object ownership and permissions. Main difference for the item you are trying to update is changing the rest endpoint to /data/props/calcfields. ... View more

The below SPL should show the desired end status. This can also be done within props and transforms if you wish for this to be done for all data of that specific sourcetype. | makeresults | eval test="copy and upload completed for day: 2019-05-27 Tue May 28 12:24:40 UTC 2019~ going to copy total size of: 25.1 MiB~ starting time: Tue May 28 12:24:40 UTC 2019" | fields - _time | rex field=test "(\w*\s){3}(?<Status>\w*)[^:]*:\s+(?<StatusTime>[^\n]*)\n[^:]*:\s+(?<TotalSize>[^\n]*)\n[^:]*:\s+(?<StartingTime>.*)" This can also be done within props and transforms if you wish for this to be done for all data of that specific sourcetype. ... View more

The KERNEL variable is not set within the OS but rather from another script within the Splunk_TA_nix. As the first line of the rlog.sh consists of: . `dirname $0`/common.sh Within this common.sh the KERNEL variable is set using: # # # what OS is this? KERNEL=`uname -s` This is common across all Splunk_TA_nix scripts in how they run as many things are OS dependent. I would ensure that this common.sh is running properly as the need for commenting out the KERNEL if/elif segments shouldn't be needed. ... View more

I would look further look into the namespace that is required to reach the saved search you are trying to disable. https://docs.splunk.com/Documentation/Splunk/7.2.3/RESTUM/RESTusing#Namespace As most likely is that the rest endpoint either doesn't have access to that search or is just creating a new search that its disabling automatically but is never hitting the originating saved search. If this saved search name is unique an easy way to edit this search is by the following command: curl -k -u admin:pass https://localhost:8089/servicesNS/-/-/saved/searches/TestSearch/ \ disable -X POST As this will be looking over over all levels of access (private,app,global) for the saved search that matches TestSearch. ... View more