Unable to Remove Orphaned Search.

Available Languages

Updated:September 28, 2026

Document ID:SPLK044258

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Enterprise

Description

There is a message showing on Splunk GUI about an orphaned search for a deleted user, however, after going to Reassign Knowledge Objects in Splunk web, there is no orphaned search found under the user that is mentioned on the GUI's message.

Investigation

After checking for $SPLUNK_HOME/etc/users/deleted.user/search/local/savedsearches.conf the file is found empty. At this point, the documentation cannot be followed since this scenario is not described.

Resolution

How to fix it:
Search for metadata under the deleted.user's name in order to identify where is the orphaned search.

For Linux:

find . -name '*.meta' | grep -iH <deleted.user>

for Windows:

get-childitem C:\ -name -recurse *.meta*

Through the searches a savedsearches.conf file should be found under the deleted.user ownership containing the orphaned search.

After changing the ownership the GUI message will no longer show.