topic Reassign Knowledge Object app in Getting Data In

Reassign Knowledge Object app

SplunkExplorer — Tue, 07 Nov 2023 14:21:19 GMT

Hi Splunkers, in our Splunk Cloud environment we had 2 need:

Reassign knowledge object owner
Reassign Knowledge object app

The first point management is well known and we already applied it, assigning all KOs created by us to a service account. I don't remember if the second one is possible: can I reassign a KO app? For example, if we assigned an alert to search app, is it possible to change it with another one? And if yes, how?

Re: Reassign Knowledge Object app

richgalloway — Tue, 07 Nov 2023 14:52:17 GMT

Some KOs can be assigned to new apps. Look for "move" as an edit option.

For those KOs that cannot be moved, you'll have to do so manually. Create a new object by the same name in another app and copy/paste the values from the original app. Then delete the original object. In Splunk Cloud, do this in an app you then upload. If the original app is Search then you cannot upload a replacement app and will have to manipulate the object in the UI.