Community
Splunk Answers
Splunk Administration
Deployment Architecture
Getting Data In
Installation
Security
Knowledge Management
Monitoring Splunk
Using Splunk
Splunk Search
Dashboards & Visualizations
Splunk Dev
Alerting
Reporting
Other Usage
Splunk Platform Products
Splunk Enterprise
Splunk Cloud Platform
Splunk Data Stream Processor
Splunk Data Fabric Search
Splunk Premium Solutions
News & Education
Blog & Announcements
Community Blog
Product News & Announcements
Practitioner Resources
Great Resilience Quest
Training & Certification
Training + Certification Discussions
Training & Certification Blog
Community Lounge
Getting Started
Welcome & Intros
Feedback
SplunkTrust
User Groups
Splunk Love
Apps and Add-ons
All Apps and Add-ons
User Groups
Resources
SplunkBase
Developers
Documentation
Splunk Ideas
Sign In
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
All community
Knowledge base
dhruv05
Users
Products
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search instead for
Did you mean:
Ask a Question
About dhruv05
dhruv05
New Member
Member since:
10-13-2017
11-04-2021
Community Statistics
Posts
2
Solutions
0
Karma Given
0
Karma Received
0
Member Since
10-13-2017
View all badges
Activity Feed
Posted
Re: Re-assigning or deleting the orphaned searches
on
Splunk Search
.
10-13-2017
01:15 PM
Posted
Re: How do I find an orphaned search in Splunk 6.4.1?
on
Splunk Search
.
10-13-2017
12:24 PM
Topics I've Started
No posts to display.
View All
Latest Contributions by dhruv05
Topics dhruv05 has Participated In
Latest Contributions by dhruv05
Re: Re-assigning or deleting the orphaned searches
by
dhruv05
in
Splunk Search
10-13-2017
01:15 PM
10-13-2017
01:15 PM
For deleting OR re-owning the scheduled-search or view Go the app [/etc/apps//local/metadata/local.meta] Either delete the search or re-own the scheduled-search using a service a/c
... View more
Re: How do I find an orphaned search in Splunk 6.4...
by
dhruv05
in
Splunk Search
10-13-2017
12:24 PM
10-13-2017
12:24 PM
Try this.. | rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0 | search orphan=1 disabled=0 is_scheduled=1 | eval status = if(disabled = 0, "enabled", "disabled") | fields title eai:acl.owner eai:acl.app eai:acl.sharing orphan status is_scheduled cron_schedule next_scheduled_time next_scheduled_time actions | rename title AS "search name" eai:acl.owner AS owner eai:acl.app AS app eai:acl.sharing AS sharing
... View more
Contact Me
Online Status
Offline
Date Last Visited
11-04-2021
08:09 PM