Splunk Enterprise

Bulk Reassign?

Kenny_splunk
Path Finder

Hey guys, i sometimes have the task of reassigning ownership to certain teams, and at times it can be multiple dashboards/alerts at once. I have the option to select multiple dashboards/alerts , but when I try to reassign all at once, it doesn't work. 

I remember someone mentioning that it can be done, so i wanted to talk with my favorite community.

thanks again.

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

here is one old post which contains link to one python script to do this. https://community.splunk.com/t5/Dashboards-Visualizations/Can-we-move-the-saved-searches-or-knowledg...

As it already said you can select all those objects under Reassign Knowledge Objects. 

isoutamo_0-1731621230614.png

After that it gives to you possibility to do bulk reassign for those.

Usually this work as expected, but time by time You cannot change all those KOs with GUI. Then just use previously mentioned python script and it do the rest.

r. Ismo

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

it's possible to change the ownership of orphaned (or not) knowledge objests in [Settings > All Configurations > Reassign Knowledge Objects] and then modifying filters.

Ciao.

Giuseppe

Kenny_splunk
Path Finder

Yes, but can i bulk reassign? instead of having to do it one at a time?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Kenny_splunk ,

you have to flag all the knowledge objects to reassign and then reassign them in a time.

Eventually, you can flag all KO in a time.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...