How to manage and transfer assets before deleting a Splunk Enterprise account

[daeju]

Hi everyone,

I'm a new Splunk Enterprise administrator. I'm about to delete the previous administrator's account and create a new one for myself. However, I have a few questions before I proceed.

The previous administrator created numerous saved searches, lookup files, and scheduled tasks. Before deleting the account, I would like to:

1. Verify account assets: Is there a way to view all the saved searches, lookup files, dashboards, and other assets owned by the account that I'm about to delete?
2. Assign assets: How can I transfer ownership of these assets to my new account or configure my new account to access them?

I'm concerned that deleting the account without taking these precautions might disrupt ongoing scheduled tasks.

Any advice or experience you can share would be greatly appreciated. Thank you.

[isoutamo]

If there are some scheduled alerts/reports etc. then those cannot run after account has removed.

There are some ways to transfer ownership of those to you. Maybe the easiest is just remove account and then splunk warning you that there are some scheduled tasks which haven't owner and give you a link where you can change ownership.

Another way is go Settings -> All Configurations 

Then on top right is button "Reassign knowledge objects" and use it.

Third option is use external command which can change those on cli. You could found it from some old answers.