Splunk Enterprise

Bulk Reassign?

Kenny_splunk
Path Finder

Hey guys, i sometimes have the task of reassigning ownership to certain teams, and at times it can be multiple dashboards/alerts at once. I have the option to select multiple dashboards/alerts , but when I try to reassign all at once, it doesn't work. 

I remember someone mentioning that it can be done, so i wanted to talk with my favorite community.

thanks again.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

it's possible to change the ownership of orphaned (or not) knowledge objests in [Settings > All Configurations > Reassign Knowledge Objects] and then modifying filters.

Ciao.

Giuseppe

Kenny_splunk
Path Finder

Yes, but can i bulk reassign? instead of having to do it one at a time?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

you have to flag all the knowledge objects to reassign and then reassign them in a time.

Eventually, you can flag all KO in a time.

Ciao.

Giuseppe

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...