for saved searches you can either delete them from savedsearches.conf or change owner, You can update the metadata in the location where the savedsearches.conf file exists. For instance, I've got a saved search in $SPLUNK_HOME/etc/apps/search/local, I can change the owner in $SPLUNK_HOME/etc/apps/search/metadata/local.meta. Determine the app that the savedsearch (or tag or eventtype etc) belongs to. Edit the file
$SPLUNK_HOME/etc/apps/[appname]/metadata/local.meta
Find the item(s) that need to be changed, and update the owner field.
[savedsearches/mysearch]
export = none
owner = admin
version = 6.2.3
modtime = 1394164870.793299000
or you want it to be done using CLI -
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html
... View more