Not able to find orphaned search

Applicability

Description

Search head cluster
Splunk version: 7.3.4
ES configured_version = 6.0.1-2
Not able to see the orphan searches on GUI But confirmed that the notification messages are generated daily for two orphaned searches

Investigation

Warning log:
 

WARN SearchOperator: rest - sid: Restricting results of the "rest" operator to the local instance because you do not have the "dispatch_rest_to_indexers" capability.

dispatch_rest_to_indexers Is a Capability needed to see many aspects of  the Splunk Environment

Resolution

The orphaned saved searches are found under:-

$SPLUNK_HOME/etc/users/aa/SplunkEnterpriseSecuritySuite/local:
Command: less savedsearches.conf
 

Use the Reassign Knowledge Objects page in Settings.

The Reassign Knowledge Objects page in Settings is the only orphaned knowledge object detection method that detects all knowledge objects (not just searches, reports, and alerts). However, it can only find knowledge objects shared with the app or globally.

Steps

1. Select Settings > All Configurations.
2. Click Reassign Knowledge Objects.
3. Click Orphaned to filter out non-orphaned objects from the list.

At this point, the list should only contain orphaned objects that have been shared. Now, determine what to do with the items on that list.

Related Links

Splunk Documentation

Resolveorphanedsearches