Your identity provider should be able to map the LDAP usernames to SAML usernames. When you do this, you won't need to reassign knowledge objects including saved searches. In our case we mapped samAccountName to realName (this is a config on the identity provider side) in order to keep user directories the same. ... View more

Also worth a comment that pre-7.2, you could still migrate the buckets from standalone to multisite cluster. The difference pre-7.2 is that the buckets will replicate but only within the site the buckets were sent to, based on the single-site replication settings. Like you said, due to the new parameter in 7.2, you get to replicate buckets across the multisite environment as though they were generated natively. ... View more

You could try this to get the fields you're looking for: | rest /servicesNS/nobody/SA-ITOA/itoa_interface/kpi_base_search | eval value=spath(value,"{}") | mvexpand value | eval base_search = spath(value, "base_search") | eval title = spath(value, "title") | eval metric_titles=spath(value, "metrics{}.title") | eval threshold_fields=spath(value, "metrics{}.threshold_field") | eval entity_calculation=spath(value, "metrics{}.entity_statop") | eval service_calculation=spath(value, "metrics{}.aggregate_statop") | eval units=spath(value, "metrics{}.unit") | fields title, base_search, metric_titles, threshold_fields, entity_calculation, service_calculation, units Alternately you could rework the above search so each row contains all elements of the metric you're interested in. ... View more