topic Re: Why are views not available in splunk web using Splunk 6.0.1? in Security

Why are views not available in splunk web using Splunk 6.0.1?

abhayneilam — Wed, 03 Dec 2014 11:21:55 GMT

Hi,

I have created a view from splunk web under one application and when I am searching it by putting the same name in the search button, it is showing empty list.

When I check from unix, I find that view in my ....user directory. I have to copy and paste each and every view and other settings from my user directory to the app/local directory to get it work.

Please let me know why it is happening and how to get rid of this. I am using 6.0.1 version splunk

Thanks in Advance !!

Re: Why are views not available in splunk web using Splunk 6.0.1?

lguinn2 — Wed, 03 Dec 2014 22:36:49 GMT

You shouldn't be moving this from the user directory manually. Go to Settings, then choose User Interface and finally Views.

You should set the permissions for the view to "App" and then the view will be automatically moved to the app level from the user level - and you get to specify who can use the view.

Re: Why are views not available in splunk web using Splunk 6.0.1?

abhayneilam — Thu, 04 Dec 2014 08:59:24 GMT

But again, after creating views, I am searching my view name in the search button in the same application where I have created the view but it is still invisible ( that is the main problem ) view is not visible.

I can only find view through putty in my unix box. Once I copy from my user local to app local then only my view is visible in splunkweb.

Please let me know if you need more clarification on this !! My problem is that I am not able to find my view, then how do I change the permission. View is not visible at all unless I am moving it from user local directory to the app local directory.

Re: Why are views not available in splunk web using Splunk 6.0.1?

MuS — Thu, 04 Dec 2014 09:20:54 GMT

I think you misunderstand something here, views are not searchable within Splunk using the search app and the search button...unless you index for example $SPLUNK_HOME/etc/users or $SPLUNK_HOME/etc/apps

To find a searchable view within Splunk goto this URL http://:/en-US/manager/search/data/ui/views

Re: Why are views not available in splunk web using Splunk 6.0.1?

the_wolverine — Mon, 29 Feb 2016 22:13:20 GMT

Seeing this issue as well. Certain (private) views cannot be located by Splunk (not accessible as an admin from Splunk UI in views list.) I did confirm that the view exists on the filesystem in the users private area under etc/users//search/local/data/ui/views

Have seen this in several implementations, all version 6.x