Reporting

How can I create a report showing the contents of orphaned objects for my colleagues to review?

Vijeta
Influencer

I want to reassign knowledge objects that are orphaned, which I know can do through All Configurations->Reassign Knowledge Objects.

Before reassignment I need to download all the orphaned objects so that respective teams can review it for deletion or reassignment to a new owner.

How can I download all orphaned KOs at once?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| rename eai:acl.owner AS user 
| where user!="nobody" AND user!="splunk-system-user" 
| eval is_orphan="true" 
| join type=outer user 
    [| rest /services/authentication/users splunk_server=local
    | stats count by title 
    | rename title AS user 
    | eval is_orphan="false"] 
| where is_orphan="true"
| fields title eai:acl.app user is_scheduled search
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| rename eai:acl.owner AS user 
| where user!="nobody" AND user!="splunk-system-user" 
| eval is_orphan="true" 
| join type=outer user 
    [| rest /services/authentication/users splunk_server=local
    | stats count by title 
    | rename title AS user 
    | eval is_orphan="false"] 
| where is_orphan="true"
| fields title eai:acl.app user is_scheduled search
---
If this reply helps you, Karma would be appreciated.

Vijeta
Influencer

Perfect, was able to get all KOs by writing query for each type. Thank you @richgalloway !!

0 Karma

Vijeta
Influencer

@renjith.nair @richgalloway @woodcock @niketnilay @kamlesh_vaghela Any idea?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...