Splunk Enterprise

How to change an owner of 'data model' object?

NoSpaces
Communicator

Hello to everyone.
Every dashboard with any type of "visualization" (pivot, for example) needs a data model.
Data models have an owner, just like other objects.
But how can I reassign the data model to another user?
I tried to use 'Reassign knowledge object' but I can't find any objects with this type.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

actually DM is optional for most of visualisations. I'm not sure if pivot is the only one which needs DM?

Have you example where you see a DM under Datasets and you cannot change it's ownership to another user?

r. Ismo

NoSpaces
Communicator

It isn't important for which scenarios needed DM. 
Main question is where I can change a DM ownership?

As you see on the first screenshot I have DM with owner test_spl.
But as you see on the second I can't find it it at 'Reassign Knowledge Object' panel.

1.png2.png

0 Karma

isoutamo
SplunkTrust
SplunkTrust

I afraid that only way to change ownership is to edit local.meta or export/remove/import that datamodel with different user? If you are using SHC then don't edit local.meta, instead use deployer to update it and then you should put all definitions to some other application than Search & Reporting, which you should NEVER update via SHC Deployer! 

NoSpaces
Communicator

Thank you for your advice.
Described approaches do not look like "best practices.".
I'm new to Splunk and for me, it seems that I use the wrong method to resolve the task.
Is DM "desined" to change ownership, or maybe I must create these objects only from certain user?
From the admin account for example.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

As usually this depends. On dev environments you just created those KO under some app which you are developed for some purpose. Then just change ownership as you want those to be on production. Then package that app and deploy to your production.

If/when you are doing those directly in production you should deiced which way is the best or enough good for your purpose. Can those DM's owned by several individuals or should you have e.g. some service users which own all KOs for special area (like individual business system)? Both approach has their pros and cons, as I said it totally depends on your own environment. Personally I like those service users instead of use individuals ,-)

NoSpaces
Communicator

Thank you for your meaningful answer
I will think about what is better in my environment

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...