topic Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix? in Dashboards & Visualizations

Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 28 Sep 2020 18:07:07 GMT

I am working in an 5.x environment with several searchheads and several indexers. When I go the the UI, I can find my dashboards, searches, etc. But, with full root access to the unix file system, I cannot find the source files.

It's been a while since I worked with splunk at the development level, but this is driving me crazy as it doesn't seem like rocket science. Yet, for example, I have a dashboard called XTA_dashboard. I cannot find any files named, or containing this text, except for in log files. Where would this custom dashboard be saved, on the searchhead, and in what folder, assuming an app called xta_app.

Thanks

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 16:25:21 GMT

I mean to ask where the custom dashboard would be, on the searchhead, or on the indexer, and in what folder....

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 16:35:07 GMT

saved searches
- $/splunk/etc/apps/xta_app/default/savedsearches.conf

dashboards

$/splunk/etc/apps/xta_app/local/data/ui/views/

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 16:38:07 GMT

Thanks jclehmuth

This is exactly what I would have thought. But, I am looking at the $/splunk/etc/apps folder on the search head on which I am using the gui, and no xta_app directory exists. Thus the reason I'm stumped.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 16:42:54 GMT

What does it say on the gui under folder name?

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 16:47:52 GMT

Also, did you look in the deployed apps folder?

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 16:50:11 GMT

Not sure where I should look for a folder name. I'm looking at the views in Manager and see no folder name listed. Just "view name" "owner" "app" "sharing" "status" and "actions"

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 16:53:11 GMT

If you click on apps or app management it will show you a list of all apps that are installed. It has name, folder name, version etc.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 16:57:42 GMT

it shows xta_app under the foldername field, but no such folder exists on the searchhead.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 16:58:43 GMT

Is there a deployed apps folder in etc? If there is look in there.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 17:03:10 GMT

splunk@sh1:/hosting/apps/splunk/etc>$ find . -name xta_app
$

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

dolfantimmy — Mon, 10 Nov 2014 17:03:25 GMT

no such folder exists

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

jclehmuth — Mon, 10 Nov 2014 17:11:26 GMT

Did you check the search head or indexer that it was created on? If you can't find the app then I'm not sure where it would be but check to see if the dashboard is saved in the search app.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

ewoo — Mon, 28 Sep 2020 18:10:16 GMT

Are you using search head pooling?

If search head pooling is enabled, "active" configurations are located on shared storage instead of in $SPLUNK_HOME/etc. The mount point splunk uses is set in $SPLUNK_HOME/etc/system/local/server.conf, in the "storage" attribute of the [pooling] stanza.

Re: Where to find dashboard source files in a Splunk 5.x distributed search environment on Unix?

mikclrk — Mon, 10 Sep 2018 04:58:01 GMT

Check the dashboards permissions (apps -> your_app -> View Objects). Just found out that if sharing is set to private, it's not placed in the app local directory, but hidden somewhere else. Changing the sharing to App places the dashboard into the apps local/data/ui/views folder.

This was with Splunk 7.1.2 so it might not be entirely accurate for Splunk 5.