topic Re: My dashboards and reports suddenly disappeared in Web UI in Dashboards & Visualizations

My dashboards and reports suddenly disappeared in Web UI

ffloimair — Tue, 04 Jun 2019 10:49:25 GMT

I'm in the process of migrating a single-host Splunk system to a two-host (1 indexer + 1 searchhead) setup.
I already had everything up and running properly, but now suddenly all my reports and dashboards have disappeared from the Web-UI.

I carefully compared the old and the new setup and everything seems to be in place where they should be (in $SPLUNKDIR/etc/apps/*).

So to summarize: I haven't changed anything (no config changes, no restarts) since last week but now suddenly the Dashboards are no longer visible.

Any hint of what to do here?

Re: My dashboards and reports suddenly disappeared in Web UI

VatsalJagani — Tue, 04 Jun 2019 11:56:47 GMT

Hi @ffloimair,

Check if dashboard (etc/apps//default/data/ui/views/) and reports (etc/apps//default/savedsearches.conf) is present or not on search-head.

Re: My dashboards and reports suddenly disappeared in Web UI

ffloimair — Tue, 04 Jun 2019 12:05:05 GMT

Yes, they are present

Re: My dashboards and reports suddenly disappeared in Web UI

VatsalJagani — Tue, 04 Jun 2019 12:09:12 GMT

Try restarting splunk search head. It ideally should show in Settings > User Interfaces > Views and Settings > "Select Permission in front of your dashboard".

Re: My dashboards and reports suddenly disappeared in Web UI

ffloimair — Tue, 04 Jun 2019 13:11:41 GMT

Did a restart and tried as suggested, but it doesn't show up there either.

Re: My dashboards and reports suddenly disappeared in Web UI

ffloimair — Thu, 06 Jun 2019 14:52:12 GMT

I figured out the problem. It was a stupid mistake on my side. I have a loadbalancer in front and that actually pointed to the indexer instead of the searchhead. Once I access the searchhead directly everything works as expected.