Exporting Knowledge objects with their permissions in CSV

[ohoparty]

Is it possible to export a list of all the different knowledge objects and the permissions they hold in a CSV file or something?

[gjanders]

What's the goal? If it's backup/restore you could consider something like: VersionControl For Splunk or some of the alternatives on SplunkBase...

[dmarling]

Run this search and then export into a csv:

| union maxtime=300 timeout=300 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/extractions" 
    | eval type="extractions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/views" 
    | eval type="view" ] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/calcfields" 
    | eval type="calculated fields"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/fieldaliases" 
    | eval type="field aliases"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/transforms/extractions" 
    | eval type="field transformations"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/sourcetype-rename" 
    | eval type="sourcetype renaming"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/workflow-actions" 
    | eval type="Workflow actions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/times" 
    | eval type="Time Ranges"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/searches" 
    | eval type="Saved Searches/Alerts/Reports"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/models" 
    | eval type="Data Models"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/eventtypes" 
    | eval type="Event Types"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/fvtags" 
    | eval type="List by Field value pair"] 
    [| rest splunk_server="local" "/servicesNS/-/-/saved/ntags" 
    | eval type="List by tag name"] 
    [| rest splunk_server="local" "/servicesNS/-/-/admin/tags" 
    | eval type="Tags"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/lookup-table-files" 
    | eval type="lookup table files"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/transforms/lookups" 
    | eval type="Lookup Definitions"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/props/lookups" 
    | eval type="Automatic lookups"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/nav" 
    | eval type="App UI"] 
    [| rest splunk_server="local" "/servicesNS/-/-/data/ui/panels" 
    | eval type="Pre-built panels"] 
    [| rest splunk_server="local" "/servicesNS/-/-/messages" 
    | eval type="Bulletin Messages"] 
    [| rest splunk_server="local" "/servicesNS/-/-/admin/macros" 
    | eval type="Search Macros"] 
| table type title eai:acl.app author eai:acl.perms.read eai:acl.perms.write

I believe this gets most of the knowledge objects. Let me know if it misses anything.

[efavreau]

@ohoparty If this answer works for you, please accept it. Otherwise, comment on the answer.