Getting Data In

Reassign Knowledge Object app

SplunkExplorer
Contributor

Hi Splunkers, in our Splunk Cloud environment we had 2 need:

  • Reassign knowledge object owner
  • Reassign Knowledge object app

The first point management is well known and we already applied it, assigning all KOs created by us to a service account. I don't remember if the second one is possible: can I reassign a KO app? For example, if we assigned an alert to search app, is it possible to change it with another one? And if yes, how?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Some KOs can be assigned to new apps.  Look for "move" as an edit option.

For those KOs that cannot be moved, you'll have to do so manually.  Create a new object by the same name in another app and copy/paste the values from the original app.  Then delete the original object.  In Splunk Cloud, do this in an app you then upload.  If the original app is Search then you cannot upload a replacement app and will have to manipulate the object in the UI.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Some KOs can be assigned to new apps.  Look for "move" as an edit option.

For those KOs that cannot be moved, you'll have to do so manually.  Create a new object by the same name in another app and copy/paste the values from the original app.  Then delete the original object.  In Splunk Cloud, do this in an app you then upload.  If the original app is Search then you cannot upload a replacement app and will have to manipulate the object in the UI.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...