Dashboards & Visualizations

Can we move the saved searches or knowledge objects created under user local profile to the specific apps?

Navanitha
Path Finder

Hi,

I see some saved searches and knowledge objects created under user local profile like below

/opt/splunk/etc/users/username/search/local/savedsearches

Can I append above "savedsearches" file to the "savedsearch" file under app folder like /opt/splunk/etc/apps/search/local/ ?

As we are migrating our Splunk infra to a new one, I am trying to clean up things and this effort is part of the migration.  Not sure if this makes sense but I would want all the savedsearches at one location which is /opt/splunk/etc/apps/.

 

If this is possible, how can I implement it and will there be any impact ?

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When users change the permissions on their knowledge objects from private to app-level sharing, Splunk will move the object to the selected app and change the metadata files appropriately.  Splunk also will make sure there are no duplicate KO names in the same app.  What you suggest will work (use a custom app rather than search), but I recommend letting Splunk (and your users) do the work.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When users change the permissions on their knowledge objects from private to app-level sharing, Splunk will move the object to the selected app and change the metadata files appropriately.  Splunk also will make sure there are no duplicate KO names in the same app.  What you suggest will work (use a custom app rather than search), but I recommend letting Splunk (and your users) do the work.

---
If this reply helps you, Karma would be appreciated.

Navanitha
Path Finder

This helped Thank you @richgalloway 

isoutamo
SplunkTrust
SplunkTrust

Hi

if/when you have enough capability (like admin role) you could move those to another app and also give permission to app or even global.

You could try Settings -> All Configurations then Push "Reassign Knowledge Objects".

Just select correct one and reassign it as you want.

There is also some python scripts which you could use for this like https://github.com/harsmarvania57/splunk-ko-change

r. Ismo

0 Karma

Navanitha
Path Finder

@isoutamo  New thing I learned, Thank you.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...