Reassign Knowledge Object app

[SplunkExplorer]

Hi Splunkers, in our Splunk Cloud environment we had 2 need:

• Reassign knowledge object owner
• Reassign Knowledge object app

The first point management is well known and we already applied it, assigning all KOs created by us to a service account. I don't remember if the second one is possible: can I reassign a KO app? For example, if we assigned an alert to search app, is it possible to change it with another one? And if yes, how?

[richgalloway · Accepted solution]

Some KOs can be assigned to new apps.  Look for "move" as an edit option.

For those KOs that cannot be moved, you'll have to do so manually.  Create a new object by the same name in another app and copy/paste the values from the original app.  Then delete the original object.  In Splunk Cloud, do this in an app you then upload.  If the original app is Search then you cannot upload a replacement app and will have to manipulate the object in the UI.