How do you change the ownership of saved reports in 6.5.2?

[jkrehrer22]

Hi All,

I need to change ownership of some saved reports to a different user. I completed the following on our three search heads (distributed):

1. splunkhome/etc/apps/search/metadata vi local.meta
2. searched and replaced the user with the new user
3. Did this to all three search heads
4. https://xxxxxxx.com:8000/en-us/refresh/debug
5. Refreshed

I am still seeing the same owner when looking at the saved searches on the web. I did NOT restart the search heads as all the documentation I visited said that I did not need to do this.

We are running a distributed enterprise environment at version 6.5.2.

What else do I need to do?

Thank you for any help.

[gjanders]

You can use the REST API to change the ownership, I recently did a server to server migration and created a script for this transfersplunkknowledgeobjects.py

The script won't work for what you are trying to do but the endpoints are relevant, however if you only goal is to reown the items to a new user try the reownItems script I have or just call the REST endpoints listed...

[Rob2520]

@jkrehrer22 The easy process that i follow is ...via UI go to settings --> All configuration --> choose your App --> Click on reassign knowledge objects --> choose the alerts and reassign to new owner. This process doesn't need any restart. Apply the same on other search heads.

[jkrehrer22]

Hey, thanks for the reply.

I don't know if it's because I'm running version 6.5.2, but I don't see "reassign knowledge objects" from all configurations --> my saved searches.

[gjanders]

This is not available in 6.5.x, I believe that might have been a 6.6 feature

[sir_lamneth]

I don't see the default.meta or local.meta that is called out here on files that don't need a restart:

https://docs.splunk.com/Documentation/Splunk/6.5.2/Admin/Configurationfilechangesthatrequirerestart

When I made an ownership change to local.meta, it went into effect after a restart. Is there a specific reason you didn't restart? You mention being in a distributed environment — does that mean search head cluster? Are your SH apps being managed using a Deployment Server? If so, then you shouldn't manually edit the config files on each individual SH, but rather let your deployment process control the change application (Deployer pushing things for SH Cluster, or the SH getting its new config from a Deployment Server).

[jkrehrer22]

Hey, thanks for your reply!

So, I noticed today that the owners did change when I manually edited the file locally. (took some time to refresh, I guess). You make a good point about pushing configuration files from a deployer or Deployment Server.

That being said, how would I be able to push this configuration file from the deployer to our clustered search heads? My idea would be to copy local.meta from one of the search heads and place it inside the same path within the deployer. Then just push the configurations? The deployer is already connected to our SH cluster.

Thanks again!