There are descriptions on managing orphanedknowledgeobjects after deletion of users, for reasons such as change of operator in the following manuals.
http://docs.splunk.com/Documentation/S...
I have a couple orphaned searches owned by a user who is no longer with the company ( his user id was deleted ) . Im trying to re enable those searches but im unable to find them under Reassign Knowledge...
I am trying to change the ownership of a dashboard in splunk enterprise version 6.6x. It looks like I might be able to do it through the REST api but I so far have only found a way to change the owne...
I run following search to look for orphaned searches/alerts:
| rest splunk_server=local /servicesNS/-/-/saved/searches add_orphan_field=yes count=0
| search orphan=1 disabled=0 is_scheduled=1...
There were a few orphaned searches that were linked to a user that had left. I had reassigned these (knowledgeobjects) to a current user, but the alerts still appear on the message board.&n...
We had a user that setup a scheduled search to run weekly and would send report by email. We are setup for LDAP authentication and this user has left our company and their AD account has been remove...
Hi,
we had a user who is no more with our company and we had deleted his account from splunk long back. Now I still see that I keep getting report from his ID. I tried to look for that report and...
...ould be useful if the knowledgeobjectmanagement interface in splunk web provided some sort of dependency enumeration (and perhaps search and replace) upon request for delete or clone or rename, etc. J...
I've got some users who are no longer around in my Splunk instance and I want to remove the user created objects. Is there a procedure I can follow for this task?