- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Searches and reports show no owner...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Searches and reports show no owner...
I have several saved searches and reports that are not working. When I view them in the searches and reports page it says they have no owner. How can I assign an owner to these searches and reports? Do all of the searches and reports need to have an owner in order to work?
We recently restored the entire system from a backup and ever since then none of our dashboards or save reports are working.
Here is an example of a search that used to work but now it returns no results.
index=cisco eventtype=cisco_firewall | top src_ip showperc=f
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Welcome.
They don't need an owner to function correctly.
Do you get any results when you manually run the searches? It sounds like it could be an index issue if you aren't getting any results but no errors. When you restored the backup how did you go about it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
ah, have you verified your eventtypes have come across ok? These are usually user specific and could have been lost in the move over
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes when I run that command it does list the CISCO index and paths. I have also verified that all the paths are valid.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is the index "cisco" displayed when you run the command, ./splunk list index - run this from the /opt/splunk/bin directory (assuming you installed to the default location)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have updated my question with an example search.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
could you post the searches? Preferably if you update your question with them and then select them in "code block" to format them nicely. Do you have any event data in the new setup?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do not get any results when I run the searches. Directories restored in the backup were..
/var
/opt/splunk
Routing logs with Splunk OTel Collector for Kubernetes
Welcome to the Splunk Community!
Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM
