our splunk deployment utilizes LDAP for auth. as such, most of our users are ldap users. One of our team members recently departed and we ended up with orphaned saved searches, which i changed the owner ship to a role acct in our ldap so that they do not get orphaned in the future. When in the local.meta file, i noted that there were a pile of other items owned by the departed user. They are multiples of:
datamodels
indexes
inputs
models
props
views
do these need to be changed as well? if so, i assume the same process as the saved searches, edit the local.meta ,then hit the button on the debug refresh link?
... View more