topic Re: Can you answer my question regarding managing orphaned knowledge objects.? in Security

Can you answer my question regarding managing orphaned knowledge objects.?

yutaka1005 — Thu, 13 Dec 2018 08:46:38 GMT

There are descriptions on managing orphaned knowledge objects after deletion of users, for reasons such as change of operator in the following manuals.

http://docs.splunk.com/Documentation/Splunk/7.2.1/Knowledge/Resolveorphanedsearches

And It has the following description in it.

-----Manual reference-----

The Reassign Knowledge Objects page, in Settings, is the only orphaned knowledge object detection method that can find all orphaned knowledge object types. It can only find orphaned knowledge objects that have been shared at the app or global levels.

In other words, knowledge objects with private privileges can not be found.

However, if a knowledge object is with privileges of app or global, admin can see it and can also change the authority of it.

Even if only the role of deleted user is set to allow read and write.

If so, what is this function for?
Also is there way to discover orphaned objects with private privileges from Splunk Web and reassign them to some other users?

I would appreciate it if you let me know.

Re: Can you answer my question regarding managing orphaned knowledge objects.?

dkeck — Thu, 13 Dec 2018 09:53:39 GMT

Hi,

See http://docs.splunk.com/Documentation/Splunk/7.2.1/Knowledge/Resolveorphanedsearches

Re: Can you answer my question regarding managing orphaned knowledge objects.?

yutaka1005 — Fri, 14 Dec 2018 00:59:58 GMT

I found it in below chapter in manual.

Reassign unshared, orphaned knowledge objects

I understood that I can't discover orphaned objects with private privileges and reassign them to some other users in Reassign Knowledge Objects page in Settings.

Instead, I have to recreate deleted user, or copy stanza to other .conf file.

Re: Can you answer my question regarding managing orphaned knowledge objects.?

dkeck — Fri, 14 Dec 2018 06:53:34 GMT

Normally you would mark the answer as accepted that provided a solution, not your comment that this solution helped..