I need to set the owner and permissions on saved searches after upgrading to 4.1.5 - where can I set these?
You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.
For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.
You can set permissions via the web in Manager>>Searches and reports. I don't know of a way to set ownership via the web, but you can modify the config file directly.
For saved searches defined in etc/apps/search/local/savedsearches.conf, the ownership and permissions are defined in etc/apps/search/metadata/local.meta. The usual caveats about modifying Splunks config files while it's running apply.