Splunk Search

remove orphaned scheduled search in Splunk 6.5.3

asimagu
Builder

hi

we have Splunk connected to Active Directory and we cannot add local users so we cannot reassign orphaned searches in order to delete them.

is there a way to delete them without reassigning them??

thanks

0 Karma

woodcock
Esteemed Legend

Any user with admin role should be able to delete them. You definitely should have at least 1 admin.

0 Karma

lguinn2
Legend

You can manually edit savedsearches.conf and local.meta to remove the stanzas.

You will need to identify the app that has these searches, to locate the appropriate configuration files.

Be sure to take a backup first!

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...