Splunk Enterprise

Bulk Reassign?

Kenny_splunk
Path Finder

Hey guys, i sometimes have the task of reassigning ownership to certain teams, and at times it can be multiple dashboards/alerts at once. I have the option to select multiple dashboards/alerts , but when I try to reassign all at once, it doesn't work. 

I remember someone mentioning that it can be done, so i wanted to talk with my favorite community.

thanks again.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

it's possible to change the ownership of orphaned (or not) knowledge objests in [Settings > All Configurations > Reassign Knowledge Objects] and then modifying filters.

Ciao.

Giuseppe

Kenny_splunk
Path Finder

Yes, but can i bulk reassign? instead of having to do it one at a time?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

you have to flag all the knowledge objects to reassign and then reassign them in a time.

Eventually, you can flag all KO in a time.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...