How do I find everything owned by a user?

[jwhughes58]

We had a user leave and before he did he asked that I change the ownership of all his reports to another employee.  I did that.  Today I found out that he owns a lookup.  When I look in knowledge objects orphans, it wasn't in there.  From what I've found online, lookups are completely different.  Is there anyway in Splunk to find everything a user owns?  I would rather be proactive and find things the the user didn't mention, rather than wait for notification that something isn't working.

TIA,

Joe

[richgalloway · Accepted solution]

The dashboard at Settings->All configurations should show everything a given user owns.  Or you can try this query

| rest /servicesNS/-/-/directory splunk_server=local
| search eai:acl.owner="foo"
| rename eai:* as *, acl.* as *
| sort owner app type
| table owner sharing app title type location

[jwhughes58]

Thanks @richgalloway for the solution.  That does exactly what I need it to do.