I have a collection of dashboards, powered by saved scheduled searches, that I would like to organize into a new app. I've read over the documentation of creating a new app. However, I can't seem to get things running as they should.
Whenever I copy the views into the proper directory of the new app, and place the saved searches into "savedsearches.conf", I get all kinds of errors saying the searches can't be found.
Then, when I create a new dashboard and reports from scratch, they show up through the GUI for views and searches, but I can't find the through the CLI!
This is getting frustrating. Help!!
I did both views and searches, yes. Now, I am getting the "Unable to get viewstate information; formatting may not be correct" error.
The problem is again that I can't find the searches in the app directory structure to remove the vsid entries. Shouldn't they be in the app directory structure of my app?
When you change the sharing permission to 'This App' from private, they should be available in etc/apps/myapp/local. Hope you're cloning both Searches and views and will change permission for both.
Will they end up in the app at some point? Even when I shared them out to the app, I don't see any instances of the searches within the directory structure of the app in the CLI ($SPLUNKHOME$/etc/apps/myapp
Check permissions on all of the components (dashboards, saved searches, etc). This might be easier via the web interface but you can also lookup in
It's essentially setting scope, as well as editing permissions to read/write. You can look under "settings -> searches and reports" and check sharing to edit what those settings are. For dashboards, there is no scope, just read/write, check under "settings -> user interface -> views".
Are you doing a splunk refresh or restart after copying view xml files and copying savedsearches.conf file?? Also, it would be a better idea to clone the objects required into your new app from GUI itself.