Can we move the saved searches or knowledge objects created under user local profile to the specific apps?

[Navanitha]

Hi,

I see some saved searches and knowledge objects created under user local profile like below

/opt/splunk/etc/users/username/search/local/savedsearches

Can I append above "savedsearches" file to the "savedsearch" file under app folder like /opt/splunk/etc/apps/search/local/ ?

As we are migrating our Splunk infra to a new one, I am trying to clean up things and this effort is part of the migration.  Not sure if this makes sense but I would want all the savedsearches at one location which is /opt/splunk/etc/apps/.

If this is possible, how can I implement it and will there be any impact ?

[richgalloway · Accepted solution]

When users change the permissions on their knowledge objects from private to app-level sharing, Splunk will move the object to the selected app and change the metadata files appropriately.  Splunk also will make sure there are no duplicate KO names in the same app.  What you suggest will work (use a custom app rather than search), but I recommend letting Splunk (and your users) do the work.

[Navanitha]

This helped Thank you @richgalloway 

[isoutamo]

Hi

if/when you have enough capability (like admin role) you could move those to another app and also give permission to app or even global.

You could try Settings -> All Configurations then Push "Reassign Knowledge Objects".

Just select correct one and reassign it as you want.

There is also some python scripts which you could use for this like https://github.com/harsmarvania57/splunk-ko-change

r. Ismo

[Navanitha]

@isoutamo  New thing I learned, Thank you.