How to find KOs owned by inactive users?

[whitecat001]

pls whats the better way to create a search query for identifying knowledge object from inactive users and cleaning it up.

[richgalloway]

Here's a query that will find most KOs owned by inactive users.  You may want to enhance it to also look for lookups.  Of course, change the '90' to whatever value you deem to be 'inactive'.

| rest splunk_server=local /servicesNS/-/-/admin/directory | fields title eai:acl.app eai:acl.owner eai:type eai:acl.sharing
| rename eai:acl.* as *
| where (owner!="nobody" AND owner!="admin")
| search [| rest splunk_server = local /servicesNS/-/-/admin/users
| fields title last_successful_login
| eval lastLogin = if(isnull(last_successful_login) OR last_successful_login=0,"never", strftime(last_successful_login, "%c"))
| eval idleDays = round((now()-last_successful_login)/86400,0)
| where (idleDays > 90 OR lastLogin = "never")
| fields title
| rename title as owner | format]

[marnall]

You can list the users using the REST API, then sort them by the number of days since last successful login:

| rest /services/authentication/users splunk_server=local
| table title email type last_successful_login
| eval days_since_last_login = round((now() - last_successful_login)/86400,1)
| sort - days_since_last_login

Then for each one, you can use the various REST apis for knowledge objects, listed at https://docs.splunk.com/Documentation/Splunk/9.2.1/RESTREF/RESTaccess

e.g. for field extractions:

| rest /services/data/props/extractions splunk_server=local
| search eai:acl.owner = "<nameofinactiveuser>"
| table attribute author eai:acl.app eai:acl.owner stanza title updated type value

Unfortunately there is no endpoint for "all knowledge objects", so you'll have to REST call for each separate type.
EDIT: nvm richgalloway found one