- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Exporting Knowledge objects with their permissions in CSV
ohoparty
New Member
03-06-2019
09:01 AM
Is it possible to export a list of all the different knowledge objects and the permissions they hold in a CSV file or something?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
gjanders
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
03-06-2019
02:37 PM
What's the goal? If it's backup/restore you could consider something like: VersionControl For Splunk or some of the alternatives on SplunkBase...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
dmarling
Builder
03-06-2019
12:52 PM
Run this search and then export into a csv:
| union maxtime=300 timeout=300
[| rest splunk_server="local" "/servicesNS/-/-/data/props/extractions"
| eval type="extractions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/views"
| eval type="view" ]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/calcfields"
| eval type="calculated fields"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/fieldaliases"
| eval type="field aliases"]
[| rest splunk_server="local" "/servicesNS/-/-/data/transforms/extractions"
| eval type="field transformations"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/sourcetype-rename"
| eval type="sourcetype renaming"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/workflow-actions"
| eval type="Workflow actions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/times"
| eval type="Time Ranges"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/searches"
| eval type="Saved Searches/Alerts/Reports"]
[| rest splunk_server="local" "/servicesNS/-/-/data/models"
| eval type="Data Models"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes"
| eval type="Event Types"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/fvtags"
| eval type="List by Field value pair"]
[| rest splunk_server="local" "/servicesNS/-/-/saved/ntags"
| eval type="List by tag name"]
[| rest splunk_server="local" "/servicesNS/-/-/admin/tags"
| eval type="Tags"]
[| rest splunk_server="local" "/servicesNS/-/-/data/lookup-table-files"
| eval type="lookup table files"]
[| rest splunk_server="local" "/servicesNS/-/-/data/transforms/lookups"
| eval type="Lookup Definitions"]
[| rest splunk_server="local" "/servicesNS/-/-/data/props/lookups"
| eval type="Automatic lookups"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/nav"
| eval type="App UI"]
[| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels"
| eval type="Pre-built panels"]
[| rest splunk_server="local" "/servicesNS/-/-/messages"
| eval type="Bulletin Messages"]
[| rest splunk_server="local" "/servicesNS/-/-/admin/macros"
| eval type="Search Macros"]
| table type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write
I believe this gets most of the knowledge objects. Let me know if it misses anything.
If this comment/answer was helpful, please up vote it. Thank you.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
efavreau
Motivator
03-29-2019
12:48 PM
@ohoparty If this answer works for you, please accept it. Otherwise, comment on the answer.
###
If this reply helps you, an upvote would be appreciated.
If this reply helps you, an upvote would be appreciated.
![](/skins/images/FE4825B2128CA5F641629E007E333890/responsive_peak/images/icon_anonymous_message.png)