topic Bulk Reassign? in Splunk Enterprise

Bulk Reassign?

Kenny_splunk — Wed, 13 Nov 2024 14:36:43 GMT

Hey guys, i sometimes have the task of reassigning ownership to certain teams, and at times it can be multiple dashboards/alerts at once. I have the option to select multiple dashboards/alerts , but when I try to reassign all at once, it doesn't work.

I remember someone mentioning that it can be done, so i wanted to talk with my favorite community.

thanks again.

Re: Bulk Reassign?

gcusello — Wed, 13 Nov 2024 14:51:03 GMT

Hi @Kenny_splunk ,

it's possible to change the ownership of orphaned (or not) knowledge objests in [Settings > All Configurations > Reassign Knowledge Objects] and then modifying filters.

Ciao.

Giuseppe

Re: Bulk Reassign?

Kenny_splunk — Wed, 13 Nov 2024 15:15:07 GMT

Yes, but can i bulk reassign? instead of having to do it one at a time?

Re: Bulk Reassign?

gcusello — Wed, 13 Nov 2024 15:37:41 GMT

Hi @Kenny_splunk ,

you have to flag all the knowledge objects to reassign and then reassign them in a time.

Eventually, you can flag all KO in a time.

Ciao.

Giuseppe

Re: Bulk Reassign?

isoutamo — Thu, 14 Nov 2024 21:55:27 GMT

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledge-objects-created/m-p/672741/highlight/true#M55102

As it already said you can select all those objects under Reassign Knowledge Objects.

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo