Splunk Dev

No "scheduled time" for my saved searches

sylim_splunk
Splunk Employee
Splunk Employee

Saved Searches not keeping configuration while changing owner by REST as below;

curl -k -u admin:changeme https://SH:8089/servicesNS/"owner name"/"app name"/saved/searches//acl -d owner=newOwner -d sharing=user 

After replace some ownership from Alerts I saw those Alerts have lost their scheduled time - they have all "none" in the list. Therefore I tried to open and saving one by one I realised those Alerts had scheduled again.
When I do the same action to the others the REST had lost them again!

Tags (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

It appears all good now after the reload command for saved searches - the changes seems not recognized by the Splunk until it gets reloaded. Make sure to run below after changes to the scheduled searches as best practice.

./splunk _internal call /servicesNS/newOwner/AppName/saved/searches/_reload

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

It appears all good now after the reload command for saved searches - the changes seems not recognized by the Splunk until it gets reloaded. Make sure to run below after changes to the scheduled searches as best practice.

./splunk _internal call /servicesNS/newOwner/AppName/saved/searches/_reload

woodcock
Esteemed Legend

You should click Accept on your answer to close the question.

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...