Splunk Enterprise

How to manage and transfer assets before deleting a Splunk Enterprise account

daeju
Observer

Hi everyone,

I'm a new Splunk Enterprise administrator. I'm about to delete the previous administrator's account and create a new one for myself. However, I have a few questions before I proceed.

The previous administrator created numerous saved searches, lookup files, and scheduled tasks. Before deleting the account, I would like to:

  1. Verify account assets: Is there a way to view all the saved searches, lookup files, dashboards, and other assets owned by the account that I'm about to delete?
  2. Assign assets: How can I transfer ownership of these assets to my new account or configure my new account to access them?

I'm concerned that deleting the account without taking these precautions might disrupt ongoing scheduled tasks.

Any advice or experience you can share would be greatly appreciated. Thank you.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If there are some scheduled alerts/reports etc. then those cannot run after account has removed.

There are some ways to transfer ownership of those to you. Maybe the easiest is just remove account and then splunk warning you that there are some scheduled tasks which haven't owner and give you a link where you can change ownership.

Another way is go Settings -> All Configurations 

Then on top right is button "Reassign knowledge objects" and use it.

Third option is use external command which can change those on cli. You could found it from some old answers.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...