I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:
Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.
Does anyone have a better/faster way to do this in version 7.0?
search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“
requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details
i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned rm -rf $SPLUNK_HOME/etc/users/<your_user>/*
hope it helps
I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...
agree, in ITSI and ES you have the option to mass edit, not sure why its not available in core
Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.