SPL to find KOs ?

[Kenny_splunk]

Hello community, I want to make it efficient when offboarding with clients. Is there an spl to find ALL of the KO's created in a particular app?

[meetmshah]

Hello @Kenny_splunk we would need to call individual rest endpoints and append results. Like, /data/props, /data/transforms. Did a quick ChatGPT and found below search - 

| rest /servicesNS/-/<app_name>/data/props
| append [| rest /servicesNS/-/<app_name>/data/transforms]
| append [| rest /servicesNS/-/<app_name>/data/macros]
| append [| rest /servicesNS/-/<app_name>/saved/searches]
| append [| rest /servicesNS/-/<app_name>/data/ui/views]
| append [| rest /servicesNS/-/<app_name>/data/ui/nav]
| append [| rest /servicesNS/-/<app_name>/data/ui/manager]
| append [| rest /servicesNS/-/<app_name>/data/ui/panels]
| append [| rest /servicesNS/-/<app_name>/data/collections/config]
| fields title, eai:acl.owner, eai:acl.app, eai:acl.sharing
| search eai:acl.app="<app_name>"
| table title, eai:acl.owner, eai:acl.sharing
| sort eai:acl.owner, title

 Replace <app_name> with specific app name (like search).

Please hit Karma, if this helps!

[isoutamo]

Hi

this conf19 presentation shows how to find all KOs via rest api. https://github.com/paychex/Splunk.Conf19
r. Ismo