I've got a large number of orphaned objects that I'd like to clean up (delete). I don't see any way to do this in the UI:
Reassign Knowledge Objects view allows me to reassign (check a bunch of boxes) to myself. Once I do this, I can see the object in my list, however, I must go in one by one and click on Edit -> Select Delete.
Does anyone have a better/faster way to do this in version 7.0?
i am not aware of a faster way from the GUI, however if you reassign to yourself as private, you can delete your relevant user directory wit hall the objects you reassigned
rm -rf $SPLUNK_HOME/etc/users/<your_user>/*
hope it helps
Gotta be a way to do this with a search that finds them and the posts to the api to delete them using the curl command in the ta-webtools app.
I have legitimate objects that I don't want deleted. As well, I would prefer not to have to assign these to myself. Guess a dummy account could work here. But come on, Splunk ...
search that finds the names of orphaned searches and returns them one row per orphaned search in a field named savedSearchName...
| urlencode savedSearchName
| map search=“| curl method=delete splunkauth=true uri=https://localhost:8089/servicesNS/admin/search/saved/searches/$savedSearchName$“
requires ta-webtools found here https://splunkbase.splunk.com/app/3420/#/details