If a search or report has its display destination set to "private," when the target user's account is deleted, the search or report will become "ownerless" and will be called "orphaned knowledge objects," which may result in unexpected behavior.

As a workaround, you can change the display destination or owner of searches, reports, etc.

*If you also want to change the owner, change the display destination of the search, report, etc. beforehand, and then change the "owner" of the search, report, etc. according to the <Reference> below.

If searches, reports, etc. are set to appear in "This app only" or "All apps," users of the app will still be able to use those searches, reports, etc., so there is no problem if you delete some user accounts.

If you want other users to continue using searches, reports, etc. that have been set to "Private," follow the steps below to change the display destination of the searches, reports, etc.

• Log in to Splunk Web as a user with the admin role and select Settings > All Preferences.
• Change "App" in the upper left to "All" and "Owner" to the user you want to delete, then display the search, report, etc. for which you want to change the settings.
• 2. Click "Permissions" in the "Shared" column for the search, report, etc. displayed in step 2.
• Change "Show <saved search or view> in" to "This app only" or "All apps."

Also, assign read/write permissions to any roles and then click "Save."

*The following patterns are available for the scope of sharing of searches, reports, etc. with other users.

• Private: Shared only with the owner who created the search, report, etc.
• This app only: Shared with users of the app (e.g. search).
• All Apps: Shared among all users, regardless of the apps they use.

*Only users with the admin role can change the "Display destination of <saved searches and views>".

To change the owner of searches, reports, etc. created by the user you are deleting, follow the steps below.

• Log in to Splunk Web as a user with the admin role and select Settings > All Preferences.
• Click Reassign Knowledge Objects on the top right.
• Expand Filter by Owner and select the user you want to delete.
• Expand "Reassign" for the knowledge object in question, select the new owner and "Save."