There are descriptions on managing orphanedknowledgeobjects after deletion of users, for reasons such as change of operator in the following manuals.
http://docs.splunk.com/Documentation/S...
I have a couple orphaned searches owned by a user who is no longer with the company ( his user id was deleted ) . Im trying to re enable those searches but im unable to find them under Reassign Knowledge...
...onfigurations \ Reassign KnowledgeObjects \ Orphaned
we have the option of reassigning these searches to other Domain Accounts belonging to regular Splunk non admin users, or to the built in d...
I am trying to change the ownership of a dashboard in splunk enterprise version 6.6x. It looks like I might be able to do it through the REST api but I so far have only found a way to change the owne...
There were a few orphaned searches that were linked to a user that had left. I had reassigned these (knowledgeobjects) to a current user, but the alerts still appear on the message board.&n...
Considering our current setup i.e authentication and Authorization integrated with SAML, how do we 1. mark an user inactive 2. what do we do with his/her knowledgeobjects.
I run following search to look for orphaned searches/alerts:
| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1...
...ould be useful if the knowledgeobjectmanagement interface in splunk web provided some sort of dependency enumeration (and perhaps search and replace) upon request for delete or clone or rename, etc. J...
We had a user that setup a scheduled search to run weekly and would send report by email. We are setup for LDAP authentication and this user has left our company and their AD account has been remove...