topic Re: How to mass delete knowledge objects in version 7.0? in Getting Data In

How to mass delete knowledge objects in version 7.0?

the_wolverine — Wed, 27 Jun 2018 22:28:23 GMT

I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:

Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.

Does anyone have a better/faster way to do this in version 7.0?

Re: How to mass delete knowledge objects in version 7.0?

adonio — Thu, 28 Jun 2018 01:15:24 GMT

i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned rm -rf $SPLUNK_HOME/etc/users/<your_user>/*

hope it helps

Re: How to mass delete knowledge objects in version 7.0?

jkat54 — Thu, 28 Jun 2018 01:37:08 GMT

Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.

Re: How to mass delete knowledge objects in version 7.0?

jkat54 — Thu, 28 Jun 2018 01:45:02 GMT

search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“

requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details

Re: How to mass delete knowledge objects in version 7.0?

the_wolverine — Thu, 28 Jun 2018 18:25:02 GMT

I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...

Re: How to mass delete knowledge objects in version 7.0?

adonio — Thu, 28 Jun 2018 18:54:29 GMT

agree, in ITSI and ES you have the option to mass edit, not sure why its not available in core