topic Re: Is there a way to restore a deleted dashboard? in Dashboards & Visualizations

Is there a way to restore a deleted dashboard?

kualo — Fri, 09 Dec 2016 16:02:11 GMT

Hi,

I accidentally deleted a dashboard.
Is there any way to bring it back?

Re: Is there a way to restore a deleted dashboard?

rjthibod — Tue, 29 Sep 2020 12:03:27 GMT

I am pretty sure the answer is no. You would want to check the "local" folder (on disk) of the app the dashboard belonged to, or check the user account folder for the username that created the dashboard. The latter is under SPLUNK_ROOT/etc/users/USER_NAME

If you remember the name of the dashboard url, you could also search the disk for that name with the .xml extension just to be double-sure.

Re: Is there a way to restore a deleted dashboard?

eugenek — Mon, 27 Nov 2017 13:30:40 GMT

I just had to do this for a report, and was able to find the query in the audit log (index=_audit). That may get you part way there.

Re: Is there a way to restore a deleted dashboard?

sbrice17 — Tue, 09 Jan 2018 15:11:32 GMT

Yes, you can search the index="_internal" "dashboard name" or keyword "purgeEligible" Remember this will be dependent on your _internal retention policy. Go through the events and you will find the xml event with the dashboard information.