How can I create a report showing the contents of orphaned objects for my colleagues to review?

[Vijeta]

I want to reassign knowledge objects that are orphaned, which I know can do through All Configurations->Reassign Knowledge Objects.

Before reassignment I need to download all the orphaned objects so that respective teams can review it for deletion or reassignment to a new owner.

How can I download all orphaned KOs at once?

[richgalloway · Accepted solution]

By "download" I presume you want to create a report showing the contents of orphaned objects for your colleagues to review, If that is so, try this search. It's for saved searches, but you should be able to modify it for other object types.

| rest /servicesNS/-/-/saved/searches splunk_server=local
| rename eai:acl.owner AS user 
| where user!="nobody" AND user!="splunk-system-user" 
| eval is_orphan="true" 
| join type=outer user 
    [| rest /services/authentication/users splunk_server=local
    | stats count by title 
    | rename title AS user 
    | eval is_orphan="false"] 
| where is_orphan="true"
| fields title eai:acl.app user is_scheduled search

[Vijeta]

Perfect, was able to get all KOs by writing query for each type. Thank you @richgalloway !!

[Vijeta]

@renjith.nair @richgalloway @woodcock @niketnilay @kamlesh_vaghela Any idea?