Creating service account in splunk to re-assign the orphaned knowledge object

[man03359]

Hi,

I am a splunk admin and we are re-assigning the orphaned knowledge object to my name as a temporary solution. I need to create a service account so that I can assign the orphaned knowledge objects to that account. I am doing it for the first time. Could some one please  specify what roles and capacities I should assign. Also is it the same process to create a service account same as how we create a local user in splunk like Settings > Users > Create User

ps. I am on splunk cloud | version: 9.3

[livehybrid · Accepted solution]

Hi

Yes, creating a service account in Splunk Cloud is the same as creating a local user via Settings > Users > Create User.

• Roles: Assign the minimum privileged role for the service account own and manage the required knowledge objects, run searches etc. Optionally, create a custom role dedicated for the service user.
• App context: Ensure the role has write permissions on relevant apps where knowledge objects reside.

This service account will then be a stable owner for orphaned knowledge objects, avoiding future orphaning if admins or users who own the KOs were to leave.

• Use a strong, unique password and store it securely.
• Document the account purpose and ownership internally.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing