topic Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views? in Dashboards & Visualizations

Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

Javo222 — Wed, 04 Mar 2015 22:21:14 GMT

When creating a dashboard from Splunk Web it appears in the list, and also under \Splunk\etc\apps\myapp\default\data\ui\views or \Splunk\etc\apps\myapp\local\data\ui\views
When adding a xml file under one on these folders, the dashboard doesn't appear in Splunk Web. I tried copy/pasting the one created from Splunk Web to duplicate directly in the folder but same problem.

A refresh using http://localhost:8000/en-US/debug/refresh?entity=data/ui/views or complete refresh doesn't help. Restarting splunk Service either.

It was working before and I'm not sure what I changed ... Any idea?

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

sideview — Wed, 04 Mar 2015 22:33:39 GMT

Since you say it was working before, the most likely answer is that either

a) the XML is now malformed. The easiest and silliest way to check this, is to drag the raw xml file into a web browser. The Browser will try to render it as an XML document and if it's malformed in any way, this will fail.

b) the XML is fine, but some param or attribute about it has become illegal. This causes Splunkweb to log some errors internally, and then refuse to put the dashboard/view into the nav, or render it when someone navigates to the URL manually. There is often a system-wide error that will then show up for all users on other views, but I don't think this is universal for all possible errors that could knock out the view - I think it's possible to have an error that doesn't trigger the big error messages in all views of the app. Searching the _internal index for error, and also the name of the view, would turn up more detail.

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

Javo222 — Thu, 05 Mar 2015 08:25:20 GMT

A) works fine
B) Good tip! I can see ERROR ConfContentsCache - Cannot read: C:\Program Files\Splunk\etc\apps\acs\local\data\ui\views\q2.xml: Access is denied.
Need to figure out what's wrong with the rights now

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

markthompson — Thu, 05 Mar 2015 11:14:44 GMT

@javo222

Dashboards you should create via Splunk Web, even if you just create it and then edit the XML file thats in the folder.

Try creating a blank dashboard and copy/paste your XML in there.

Or if you're trying to reference it it should be in the STATIC folder

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

Javo222 — Thu, 05 Mar 2015 11:25:13 GMT

According to the documentation, I can create an XML file myself and place it in the appropriate folder.
As I mention in a comment below, it seems to be permission related but I can't see what is wrong. I gave access to basically everything to everyone.

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

sideview — Thu, 05 Mar 2015 18:14:37 GMT

As a guess, the file might be owned by a real user, who has full control, but it is probably missing a separate permissions item for the SYSTEM user, which is what's relevant for Splunk, at least when installed and run with default settings. To avoid this in the future, when you're doing stuff with the views on the filesystem, you can grab an existing file from the same directory and create a copy of it, whose contents you then delete. This way you can almost forget about windows file permissions and ownership issues. 😃

Re: Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

Javo222 — Thu, 05 Mar 2015 19:46:08 GMT

Is there a way to:
- reset all default permissions in splunk? Maybe it's stored in a specific file?
- restore all default permissions under the installation files? Without the need to uninstall/reinstall?
If I try to repair the install, it says the wizard ended prematurely because of an error and has not been notified. (version 6.2.2)