Knowledge Management

Exporting Knowledge objects with their permissions in CSV

ohoparty
New Member

Is it possible to export a list of all the different knowledge objects and the permissions they hold in a CSV file or something?

0 Karma

gjanders
SplunkTrust
SplunkTrust

What's the goal? If it's backup/restore you could consider something like: VersionControl For Splunk or some of the alternatives on SplunkBase...

0 Karma

dmarling
Builder

Run this search and then export into a csv:

| union maxtime=300 timeout=300 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/extractions" 
    | eval type="extractions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
    | eval type="view" ] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/calcfields" 
    | eval type="calculated fields"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/fieldaliases" 
    | eval type="field aliases"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/transforms/extractions" 
    | eval type="field transformations"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/sourcetype-rename" 
    | eval type="sourcetype renaming"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/workflow-actions" 
    | eval type="Workflow actions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/times" 
    | eval type="Time Ranges"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/searches" 
    | eval type="Saved Searches/Alerts/Reports"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/models" 
    | eval type="Data Models"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes" 
    | eval type="Event Types"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/fvtags" 
    | eval type="List by Field value pair"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/ntags" 
    | eval type="List by tag name"] 
    [| rest splunk_server="local" "/servicesNS/-/-/admin/tags" 
    | eval type="Tags"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/lookup-table-files" 
    | eval type="lookup table files"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/transforms/lookups" 
    | eval type="Lookup Definitions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/lookups" 
    | eval type="Automatic lookups"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/nav" 
    | eval type="App UI"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels" 
    | eval type="Pre-built panels"] 
    [| rest splunk_server="local" "/servicesNS/-/-/messages" 
    | eval type="Bulletin Messages"] 
    [| rest splunk_server="local" "/servicesNS/-/-/admin/macros" 
    | eval type="Search Macros"] 
| table type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write

I believe this gets most of the knowledge objects. Let me know if it misses anything.

If this comment/answer was helpful, please up vote it. Thank you.

efavreau
Motivator

@ohoparty If this answer works for you, please accept it. Otherwise, comment on the answer.

###

If this reply helps you, an upvote would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...