What’s the best way to write a query to list all knowledge objects on a search head, and then compare it to the knowledge objects on another search head?
So far I’ve ended up using the REST endpoint of services/directory to grab most of what I need.
Splunk does not store knowledge objects in any index. Knowledge objects are contained in .conf files and .xml files that are stored in the directory hierarchy under $SPLUNK_HOME/etc
Shameless promotion: there is an app on Splunkbase called X-ray Splunk which collects information about the knowledge objects and presents it in a variety of dashboards. It doesn't seem to work yet on all OSes, but it is free.
Have a look at this ans.
https://answers.splunk.com/answers/95035/how-to-list-objects-of-an-application.html
Let me know if this helps!