Getting Data In
Highlighted

How to mass delete knowledge objects in version 7.0?

Champion

I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:

Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.

Does anyone have a better/faster way to do this in version 7.0?

0 Karma
Highlighted

Re: How to mass delete knowledge objects in version 7.0?

SplunkTrust
SplunkTrust

i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned rm -rf $SPLUNK_HOME/etc/users/<your_user>/*

hope it helps

0 Karma
Highlighted

Re: How to mass delete knowledge objects in version 7.0?

SplunkTrust
SplunkTrust

Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.

0 Karma
Highlighted

Re: How to mass delete knowledge objects in version 7.0?

Champion

I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...

0 Karma
Highlighted

Re: How to mass delete knowledge objects in version 7.0?

SplunkTrust
SplunkTrust

agree, in ITSI and ES you have the option to mass edit, not sure why its not available in core

0 Karma
Highlighted

Re: How to mass delete knowledge objects in version 7.0?

SplunkTrust
SplunkTrust

search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“

requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details

0 Karma