Getting Data In

How to mass delete knowledge objects in version 7.0?

the_wolverine
Champion

I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:

Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.

Does anyone have a better/faster way to do this in version 7.0?

0 Karma

jkat54
SplunkTrust
SplunkTrust

search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“

requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details

0 Karma

adonio
Ultra Champion

i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned rm -rf $SPLUNK_HOME/etc/users/<your_user>/*

hope it helps

0 Karma

the_wolverine
Champion

I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...

0 Karma

adonio
Ultra Champion

agree, in ITSI and ES you have the option to mass edit, not sure why its not available in core

0 Karma

jkat54
SplunkTrust
SplunkTrust

Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...