- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Adding Existing Dashboards and Reports to a New App
I have a collection of dashboards, powered by saved scheduled searches, that I would like to organize into a new app. I've read over the documentation of creating a new app. However, I can't seem to get things running as they should.
Whenever I copy the views into the proper directory of the new app, and place the saved searches into "savedsearches.conf", I get all kinds of errors saying the searches can't be found.
Then, when I create a new dashboard and reports from scratch, they show up through the GUI for views and searches, but I can't find the through the CLI!
This is getting frustrating. Help!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yeah, I checked that link out. But it keep referring to the files in the app. I can't find any of my searches in my app directory to remove those vsid entries.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Ideally they should be. Confirm from UI that they are under correct app.
For view state error, visit this.
http://answers.splunk.com/answers/22779/unable-to-get-viewstate-information
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I did both views and searches, yes. Now, I am getting the "Unable to get viewstate information; formatting may not be correct" error.
The problem is again that I can't find the searches in the app directory structure to remove the vsid entries. Shouldn't they be in the app directory structure of my app?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

When you change the sharing permission to 'This App' from private, they should be available in etc/apps/myapp/local. Hope you're cloning both Searches and views and will change permission for both.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Will they end up in the app at some point? Even when I shared them out to the app, I don't see any instances of the searches within the directory structure of the app in the CLI ($SPLUNKHOME$/etc/apps/myapp
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

All cloned objects will be private by default. They should be present under etc/users/
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, I have cloned my reports to the dashboard, and that seems to work. However, in looking through the CLI, I can't seem to find where the new cloned files are placed. Where would they be?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, I haven't been restarting my search head. Do I need to?
And for cloning, how do I control which app they go to?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Check permissions on all of the components (dashboards, saved searches, etc). This might be easier via the web interface but you can also lookup in <app_name>/metadata/local.meta
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

It's essentially setting scope, as well as editing permissions to read/write. You can look under "settings -> searches and reports" and check sharing to edit what those settings are. For dashboards, there is no scope, just read/write, check under "settings -> user interface -> views".
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I know I can control permissions through roles, but I was unclear with how to do it for apps?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Are you doing a splunk refresh or restart after copying view xml files and copying savedsearches.conf file?? Also, it would be a better idea to clone the objects required into your new app from GUI itself.
