topic Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps? in Splunk Search

There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

Nilesh3110 — Thu, 09 Jan 2020 18:11:54 GMT

I have multiple apps on shcluster, "/application/splunk/etc/shcluster/apps" . I need to check if there are any Knowledge objects related to these apps, that is to say if these apps are actually requred or not. Is there a way i can get the details of all the Knowledge objects related to an application. Any Shell script which gives me this information ?

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

jarizeloyola — Thu, 09 Jan 2020 18:48:01 GMT

You can use rest commands to know what apps those knowledge objects are associated.
There's alot of rest commands in this link https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTlist ,depends on what you need.
For example:
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTknowledge
https://docs.splunk.com/Documentation/Splunk/8.0.1/RESTREF/RESTsearch

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

Nilesh3110 — Fri, 10 Jan 2020 14:38:57 GMT

This is more of theory , I m going through them ... actually i am looking for some script which pulls up these information and gives me a report for all the related knowledge objects for an application .

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

jarizeloyola — Fri, 10 Jan 2020 14:59:58 GMT

When you run those rest command in splunk search it will give you the information you needed for the knowledge objects for example (you can run in MC):

| rest "/servicesNS/-/-/admin/savedsearch/" search="is_scheduled=1" search="disabled=0" splunk_server=sh* 
    [| makeresults 
    | eval earliest_time=relative_time(now(), "-0s@s"), latest_time=relative_time(now(), "+15m@s")
    | return earliest_time, latest_time ] 
| table splunk_server eai:acl.app eai:acl.owner cron_schedule title scheduled_times

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

Nilesh3110 — Mon, 13 Jan 2020 16:33:05 GMT

Thanks a lot jarizeloyola. I m bit confused, whats the index for the above . Or do i need to run it with Curl. If possible can u pls give me the complete command or the way i can run the above search , as the above given search does not run give anything . Thanks

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

Nilesh3110 — Tue, 14 Jan 2020 17:17:27 GMT

I tried the above but did not get any results. I searched it on the indexer serach head. Where do i need to search this query.

Re: There are a list of apps present on shcluster , how to check if any knowledge objects are associated/mapped to each apps?

jarizeloyola — Tue, 14 Jan 2020 20:25:43 GMT

it is just a sample , you can run it in any of the shc member or to the MC. you should be an admin or have the right privilege to get the result.

| rest  "/servicesNS/-/-/admin/savedsearch/" splunk_server="*"