topic How can I create a report showing the contents of orphaned objects for my colleagues to review? in Reporting https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417503#M6895 <P>I want to reassign knowledge objects that are orphaned, which I know can do through All Configurations-&gt;Reassign Knowledge Objects.</P> <P>Before reassignment I need to download all the orphaned objects so that respective teams can review it for deletion or reassignment to a new owner. </P> <P>How can I download all orphaned KOs at once?</P> Tue, 22 Jan 2019 16:01:58 GMT Vijeta 2019-01-22T16:01:58Z How can I create a report showing the contents of orphaned objects for my colleagues to review? https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417503#M6895 <P>I want to reassign knowledge objects that are orphaned, which I know can do through All Configurations-&gt;Reassign Knowledge Objects.</P> <P>Before reassignment I need to download all the orphaned objects so that respective teams can review it for deletion or reassignment to a new owner. </P> <P>How can I download all orphaned KOs at once?</P> Tue, 22 Jan 2019 16:01:58 GMT https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417503#M6895 Vijeta 2019-01-22T16:01:58Z Re: How can I create a report showing the contents of orphaned objects for my colleagues to review? https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417504#M6896 <P>@renjith.nair @richgalloway @woodcock @niketnilay @kamlesh_vaghela Any idea?</P> Tue, 22 Jan 2019 17:07:23 GMT https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417504#M6896 Vijeta 2019-01-22T17:07:23Z Re: How can I create a report showing the contents of orphaned objects for my colleagues to review? https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417505#M6897 <P>By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.</P> <PRE><CODE>| rest /servicesNS/-/-/saved/searches splunk_server=local | rename eai:acl.owner AS user | where user!="nobody" AND user!="splunk-system-user" | eval is_orphan="true" | join type=outer user [| rest /services/authentication/users splunk_server=local | stats count by title | rename title AS user | eval is_orphan="false"] | where is_orphan="true" | fields title eai:acl.app user is_scheduled search </CODE></PRE> Tue, 22 Jan 2019 18:27:48 GMT https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417505#M6897 richgalloway 2019-01-22T18:27:48Z Re: How can I create a report showing the contents of orphaned objects for my colleagues to review? https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417506#M6898 <P>Perfect, was able to get all KOs by writing query for each type. Thank you @richgalloway !!</P> Tue, 22 Jan 2019 19:44:38 GMT https://community.splunk.com/t5/Reporting/How-can-I-create-a-report-showing-the-contents-of-orphaned/m-p/417506#M6898 Vijeta 2019-01-22T19:44:38Z