How to change the ownership of an object in a Splunk version 6.x search head cluster?

[the_wolverine]

A method previously used with SH Pooling no longer seems to work for search heads in a search head cluster. In the documentation, for changing object ownership, it advises changing the owner of the object, but does not indicate how to do it:

http://docs.splunk.com/Documentation/Splunk/6.2.5/Security/BestpracticeforremovinganLDAPuser

> 3. For any searches or objects that the user owns, change the owner. You
> change it an admin user or maintenance
> account, or whatever you prefer.

(The grammar is also incorrect 🙂

[andykanthem]

If you are running version 6.6.x or higher, here is the EASY method:
- On a member of the search head cluster (or your single instance)... Settings-->All Configurations-->Click Reassign Knowledge Objects
- Sort by whatever you need to change (user usually) select the objects taking note of their app association
- Use the checkboxes on the left to select, then click the selected item count above the checkboxes to modify ownership on these objects. Be sure to select ownership which has access to the relevant indexes.

[sylim_splunk]

1) You change the ownership for any objects owned by the user on the deployer - manual editing.
Use the same method as stated here;

http://docs.splunk.com/Documentation/Splunk/6.5.0/Security/BestpracticeforremovinganLDAPuser

2) Then move to SHCluster captain, use REST call to change the ownership of objects owned by the user.
Find the REST call below for reference;
https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/Resolveorphanedsearches
https://answers.splunk.com/answers/295303/how-do-i-change-the-owner-of-a-saved-search-or-vie.html

You may want to run below as best practice after saved search object ownership have changed so that they are still scheduled correctly.
./splunk _internal call /servicesNS///saved/searches/_reload

This has been improved in 6.6 - we have a GUI, reassign knowledge object you can do this via GUI instead of REST call.

3) Push the bundle from deployer.

[somesoni2]

I believe you should be able to use the Splunk REST API to do that and SHC should replicate the changes as well. See this

https://answers.splunk.com/answers/115781/change-the-owner-of-a-saved-search-via-rest.html

[the_wolverine]

Yep, that's what I'll have to use -- updating local.meta was much simpler, however.