topic Missing Reports in Reporting

Missing Reports

marcxbrl — Thu, 27 Sep 2012 17:09:29 GMT

A couple days ago I had to force-restart my splunk server. After i restarted it my logs and searches worked fine. However my (and other users) saved searches have dissappeared. In most cases they've just completely disappeared off the list. But there's a couple under the dashboard where the title is showing but when you click on them you get:

Configuration error - we were not able to find a saved search called 'Custom Report last 30 days'.

Is there any way to recover these? What directory are the reports saved in?

Re: Missing Reports

melting — Thu, 27 Sep 2012 18:22:47 GMT

searched are save in searches.conf in several places in the $PLUNK_HOME/etc perhaps you can check there. Also you can see in manager including permissions.

Any more info is welcome. Thanks!

Re: Missing Reports

emiller42 — Thu, 27 Sep 2012 19:36:12 GMT

Saved searches can be stored in a couple of places. If the search is private to the user, then it would be under:

$SPLUNK_HOME/etc/users/USERNAME/APPNAME/local/savedsearches.conf

If it's a saved search that's shared, then it gets moved into the app itself:

$SPLUNK_HOME/etc/apps/APPNAME/local/savedsearches.conf

Look in these places for the missing content. These are what you'd want to restore from a backup to correct any corruption or missing configurations.

Re: Missing Reports

marcxbrl — Fri, 28 Sep 2012 15:37:20 GMT

Thank you. I looked at those files and they had the wrong permissions on them. Strangest thing... only the saved search files had the wrong permissions.

After correcting that the custom searches display correctly.