Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How do we reassign Knowledge Objects owned by ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How do we reassign Knowledge Objects owned by a user to another user via api ? is it possible ?
We have the "Reassign Knowledge Objects" option via SplunkCloud portal in the settings but is it possible to do it via API ?
We need to do this for all KO's owner by a specific user.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Find your Knowledge object and the owner - look at the below example and change as to your requirments.
example
curl -k -u admin_user:password https://<MY_CLOUD_STACK>splunkcloud.com:8089/servicesNS/nobody/YOU_APP/saved/searches/my_search/acl -d 'owner=new_user'-d 'sharing=global' -X POST
Heres some further help on ACL in cloud
https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/RESTTUT/RESTbasicexamples
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there anyway to reassign all the Knowledge Objects owner by a specific user ? instead of transferring one Knowledge object at a time ?
Also, is the "/my_search" in the example mentioned below the title of the Knowledge Object ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Also, is the "/my_search" in the example mentioned below the title of the Knowledge Object ?
Not quite. @deepakc only gave saved searches (aka reports) as an example. "my_search" is a URL encoded string of the title. In the example, "https://<MY_CLOUD_STACK>splunkcloud.com:8089/servicesNS/nobody/YOU_APP/saved/searches/my_search" is one property internally known as id.
Is there anyway to reassign all the Knowledge Objects owner by a specific user ? instead of transferring one Knowledge object at a time ?
Yes. To continue the example with saved searches, you can use this search to find all id's owned by the old user "old_user".
| rest /servicesNS/-/-/saved/searches/
| search eai:acl.owner = "old_user"
| fields id
Example output could be (taken from owner nobody on a standard deployment)
Then, program a script using these values to update these saved searches to new user.
To update other knowledge objects, consult REST API Reference Manual, especially Knowledge endpoint descriptions to find out how to retrieve their id's by owner. (Note saved searches is described in Search endpoint descriptions instead.)
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @yuanliu i understand it now, im able to get the id for all the knowledge objects owned by the user now
However im still not able to change the owner for the knowledge object via the rest command, i get the following error " <msg type="ERROR">You do not have permission to share objects at the system level</msg> </messages> "
My user account has the sc_admin role so permission should not be an issue, am i missing something ?
Any help is really appreciated
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@arvind_Sugajeev I also got the `You do not have permission to share objects at the system level` response when providing only `owner`. I resolved it including `owner`, `share`, and `perms.read`.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
