delete owner of scheduled searches

[deyeo]

A user created many searches, and the searches are private. Since these searches belong to the owner, before deleting this user account, i've changed the permission from "Private" to "This App" and assigned to the appropriate roles. However, after doing so, the scheduled searches have stopped running on the scheduled frequency.

Why is it so?

i'm running on Splunk 4.2.5

[deyeo · Accepted solution]

You need to transfer the owner of the saved search to another valid user before deleting the owner's user account. I had to edit the $SPLUNK_HOME/etc/apps/{AppsDir}/metadata
/local.meta config file that has old owner’s ID and change each occurrence of that to the new ower’s ID. Splunk needs to be restarted for these changes to take effect.

This is a major hidden flaw with Splunk. Because a lot of Splunk administrators do NOT know that before deleting a user and assume that the saved searches will continue to run at the scheduled frequency.

[MarioM]

when you look in splunk/etc/apps//local/savedsearches.conf are those searches still with cron_schedule set and enableSched = 1 ?