Getting Data In

How to mass delete knowledge objects in version 7.0?

the_wolverine
Champion

I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:

Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.

Does anyone have a better/faster way to do this in version 7.0?

0 Karma

jkat54
SplunkTrust
SplunkTrust

search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“

requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details

0 Karma

adonio
SplunkTrust
SplunkTrust

i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned rm -rf $SPLUNK_HOME/etc/users/<your_user>/*

hope it helps

0 Karma

the_wolverine
Champion

I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...

0 Karma

adonio
SplunkTrust
SplunkTrust

agree, in ITSI and ES you have the option to mass edit, not sure why its not available in core

0 Karma

jkat54
SplunkTrust
SplunkTrust

Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.