Cannot Reassign an Orphaned Search to a Valid Owner Using REST API

Applicability

Splunk Enterprise REST API

Investigation

Some orphaned searches owned by a couple of disabled users have been found, and the following error appears when trying to reassign them to a valid user using REST API:
 

$  curl -ku <admin>:<password> https://<SH>:<mgmt_port>/servicesNS/nobody/<app_name>/saved/searches/network usage/acl -d 'owner=<new_user>'

Example output:

<?xml version="1.0" encoding="UTF-8"?> 
<response> 
<messages> 
<msg type="ERROR">Argument "owner" is not supported by this handler.</msg> 
</messages>

The current symptom  only happens when space in the report exists.

Example: savedsearch name = "network usage"
 

Resolution

The issue can be resolved by putting the report name in URL encoding.  In the example below, %20 is placed for space. 

Example:
==

$  curl -ku <admin>:<password> https://<SH>:<mgmt_port>/servicesNS/nobody/<app_name>/saved/searches/network%20usage/acl -d 'owner=<new_user>' -d sharing=app

==


The following URL can be used to get URL Encoding name for reports. 
==
https://meyerweb.com/eric/tools/dencoder/
==

Related Links

External link: https://meyerweb.com/eric/tools/dencoder/

Revision History

Revision	Publish Date	Comments
1.0	28-Sep-2026	Initial Release