Home
Join the Community
Getting Started
Welcome
Be a Splunk Champion
SplunkTrust
Super User Program
Tell us what you think
Splunk Love
Community Feedback
Find Answers
Splunk Administration
Getting Data In
Deployment Architecture
Monitoring Splunk
Using Splunk
Splunk Search
Dashboards & Visualizations
Splunk Platform
Splunk Enterprise
Splunk Cloud Platform
Premium Solutions
Splunk Enterprise Security
Splunk Observability Cloud
Splunk ITSI
Splunk SOAR
News & Education
Blog & Announcements
Community Blog
Product News & Announcements
Training & Certification
Training + Certification Discussions
Training & Certification Blog
Events
Events
Tech Talks: Technical Deep Dives
Office Hours: Ask the Experts
User Groups
Apps & Add-ons
All Apps and Add-ons
All Apps and Add-ons
Splunk Development
Splunk Dev
Resources
SplunkBase
Developers
Documentation
Splunk Ideas
Sign In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
All community
Knowledge base
dhruv05
Users
Products
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
Ask a Question
About dhruv05
dhruv05
New Member
Member since:
10-13-2017
11-04-2021
Community Statistics
Posts
2
Solutions
0
Karma Given
0
Karma Received
0
Member Since
10-13-2017
View all badges
Activity Feed
Posted
Re: Re-assigning or deleting the orphaned searches
on
Splunk Search
.
10-13-2017
01:15 PM
Posted
Re: How do I find an orphaned search in Splunk 6.4.1?
on
Splunk Search
.
10-13-2017
12:24 PM
Topics I've Started
No posts to display.
View All
Latest Contributions by dhruv05
Topics dhruv05 has Participated In
Latest Contributions by dhruv05
Re: Re-assigning or deleting the orphaned searches
by
dhruv05
in
Splunk Search
10-13-2017
01:15 PM
10-13-2017
01:15 PM
For deleting OR re-owning the scheduled-search or view Go the app [/etc/apps//local/metadata/local.meta] Either delete the search or re-own the scheduled-search using a service a/c
... View more
Re: How do I find an orphaned search in Splunk 6.4...
by
dhruv05
in
Splunk Search
10-13-2017
12:24 PM
10-13-2017
12:24 PM
Try this.. | rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 | search orphan=1 disabled=0 is_scheduled=1 | eval status = if(disabled = 0, "enabled", "disabled") | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
... View more
Contact Me
Online Status
Offline
Date Last Visited
11-04-2021
08:09 PM