Troubleshooting orphaned knowledge objects in Splunk platform
Orphaned knowledge objects can occur when a user who created a search, dashboard, lookup, field, etc has left or moved and been deactivated in the Splunk instance. This leads to an error relating to orphaned objects, and can lead some objects such as lookups to break entirely.
You can utilise the "Orphaned Scheduled Searches, Reports and Alerts" dashboard to find out where orphaned knowledge objects are. This same information can be seen from the Messages section that you can review as an admin, however anyone with access to the Orphaned dashboard can review objects (which is useful if the person who left was your Splunk admin.)
This dashboard can be found in Search & Reporting under Dashboards. You might need to deselect filter options when looking at the list of dashboards to find it.
Now you know which ones are orphaned, you can work on reassigning them:
- Select Settings > All configurations.
- Click Reassign Knowledge Objects.
- Click Orphaned to filter out non-orphaned objects from the list.
You can now decide to reassign these to a new user, or delete them if they are no longer required.
Somerford Associates is an award winning Elite Partner with Splunk and the largest Partner Practice of Consultants in EMEA. We protect data, demonstrate that it is being managed effectively and derive greater value, by providing real-time insights to support effective decision making. With our specialist knowledge, skills, experience and strong reputation for enabling digital transformation at scale and at pace, we provide full delivery, including design, implementation, deployment and support.