Reporting

How can I create a report showing the contents of orphaned objects for my colleagues to review?

Vijeta
Influencer

I want to reassign knowledge objects that are orphaned, which I know can do through All Configurations->Reassign Knowledge Objects.

Before reassignment I need to download all the orphaned objects so that respective teams can review it for deletion or reassignment to a new owner.

How can I download all orphaned KOs at once?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| rename eai:acl.owner AS user 
| where user!="nobody" AND user!="splunk-system-user" 
| eval is_orphan="true" 
| join type=outer user 
    [| rest /services/authentication/users splunk_server=local
    | stats count by title 
    | rename title AS user 
    | eval is_orphan="false"] 
| where is_orphan="true"
| fields title eai:acl.app user is_scheduled search
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| rename eai:acl.owner AS user 
| where user!="nobody" AND user!="splunk-system-user" 
| eval is_orphan="true" 
| join type=outer user 
    [| rest /services/authentication/users splunk_server=local
    | stats count by title 
    | rename title AS user 
    | eval is_orphan="false"] 
| where is_orphan="true"
| fields title eai:acl.app user is_scheduled search
---
If this reply helps you, Karma would be appreciated.

Vijeta
Influencer

Perfect, was able to get all KOs by writing query for each type. Thank you @richgalloway !!

0 Karma

Vijeta
Influencer

@renjith.nair @richgalloway @woodcock @niketnilay @kamlesh_vaghela Any idea?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...