Orphaned Scheduled Searches, Reports, and Alerts are missing.

Applicability

Splunk Cloud Splunk Enterprise

Description

In Splunk Web UI the below message is shown:

Splunk has found 14 orphaned searches owned by 7 unique disabled users. Click to view the orphaned scheduled searches. 
Reassign them to a valid user to re-enable or alternatively disable the searches.

If you click on the link mentioned on the previous error message, you will see the list of orphan searches, but you won’t be able to disable them.
If you look for the searches in Settings > Searches, reports and alerts, you won’t be able to find them, since the users were deleted, there is no options to reassign KO.
 

Investigation

Find the location of the saved searches (savedsearches.conf ), if there are many folders and for some reason it becomes hard to find it, use the below find command:
 

find /opt/splunk -type f -exec grep -l "saved_search_name" {}

After checking for the existence of specific Orphaned searches found under the path:

$SPLUNK_HOME/etc/users/deleted.user/search/local/savedsearches.conf

Due to business criticality and importance of these scheduled reports in the daily business, wants all the Orphaned reports to be sent via email. While checking there are 14 Orphaned searches Owned by 7 unique disabled users. Those were present in their search head under Orphaned Searches.

Resolve Orphaned Searches

Below are the two reports which needs to be reassigned and the report is required at the earliest for the business need:
1. ReportName1
2. ReportName2

Reports are found at the below path:
/opt/splunk/etc/users/<user-name>/<app-name>/local/savedsearchs.conf

E.g /opt/splunk/etc/users/abc/search/local/savedsearches.conf

Resolution

Recreating the reports is faster than waiting for the internal team to reassign those KOs which is a quicker resolution.

From the path /opt/splunk/etc/users/abc/search/local/savedsearches.conf shared the below search query of the report for it to be recreated

For the report named,  [ReportName1] below is the search query:
 

action.email = 1 
action.email.allow_empty_attachment = 0
action.email.include.results_link = 0 
action.email.include.view_link = 0 
action.email.message.report = ReportName1. 
action.email.sendcsv = 1 
action.email.sendresults = 1 
action.email.to (http://action.email.to/) = 
Person1@email.com (mailto:Person@email.com) , Person2@email.com (mailto:Person2@email.com)

For the report named,  [ReportName2] below is the search query:

action.email = 1
action.email.allow_empty_attachment = 0
action.email.include.results_link = 0
action.email.include.view_link = 0
action.email.message.report = ReportName2.
action.email.sendcsv = 1
action.email.sendresults = 1
action.email.to = Person1@email.com, Person2@email.com
action.email.useNSSubject = 1
alert.expires = 90d
alert.suppress = 0
alert.track = 0
counttype = number of events
cron_schedule = 0 6 * * 1
description = ReportName2
dispatch.earliest_time = -1w
dispatch.latest_time = now
display.general.type = statistics
display.page.search.mode = verbose
display.page.search.tab = statistics
display.visualizations.show = 0
enableSched = 1
quantity = 0
relation = greater than
request.ui_disp

 

 

Related Links

 

Revision History

Revision	Publish Date	Comments
1.0	29-Sep-2026	Initial Release