This currently can't be done via the Splunk UI, however via REST this action can be done and scripted. Following https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API you can edit any knowledge object ownership and permissions. Main difference for the item you are trying to update is changing the rest endpoint to /data/props/calcfields. ... View more

And for assertHaveCommand() the following needs to be updated (line 47 of bin/common.sh from Splunk_TA_nix 6.0.2): # # # /sbin/ is often absent in non-root users' PATH, and we want it for ifconfig(8) PATH=$PATH:/sbin/ Ubuntu needs this, or it wont be able to find the "service" command when Splunk is running as non-root (splunk). # # # Append path to help find commands when running as non-root, as the non-root paths are different PATH=$PATH:/sbin/:/usr/sbin/ It's called from bin/rlog.sh as follows: assertHaveCommand service Cheers, Chris. ... View more