Splunk Enterprise

Bulk Reassign?

Kenny_splunk
Path Finder

Hey guys, i sometimes have the task of reassigning ownership to certain teams, and at times it can be multiple dashboards/alerts at once. I have the option to select multiple dashboards/alerts , but when I try to reassign all at once, it doesn't work. 

I remember someone mentioning that it can be done, so i wanted to talk with my favorite community.

thanks again.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

it's possible to change the ownership of orphaned (or not) knowledge objests in [Settings > All Configurations > Reassign Knowledge Objects] and then modifying filters.

Ciao.

Giuseppe

Kenny_splunk
Path Finder

Yes, but can i bulk reassign? instead of having to do it one at a time?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

you have to flag all the knowledge objects to reassign and then reassign them in a time.

Eventually, you can flag all KO in a time.

Ciao.

Giuseppe

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner   Watch on demand us for a demo-driven ...