Dashboards & Visualizations

Can't Share Views

David
Splunk Employee
Splunk Employee

I have one app named "CCM" (Cisco Call Manager) that has a number of views I would like to add to the menu of another app specific to my company, but I can't get them to show up in the menu of the main app. I looked at the answer here, but it didn't solve my issue.

Start of CCM's default.xml:

<nav>
<view name="flashtimeline" />
<view name="PhoneDashboard" default='true' />
<view name="PhoneFraudDashboard" />
<view name="PhoneOperationalDashboard" />
<view name="PhoneCallQualityDashboard" />
[...]

Selection of MainApp's default.xml:

<collection label="Phones">
  <view name="PhoneDashboard" />
  <view name="PhoneFraudDashboard" />
  <view name="PhoneOperationalDashboard" />
  <view name="PhoneCallQualityDashboard" />
 [...]

Selection of CCM's default.meta:

[views/PhoneDashboard]
export = system

[views/PhoneFraudDashboard]
export = system
[...]

I've also tried a variety of settings for the permissions (such as Genti suggested below), to no avail.

What am I missing here?

Tags (1)
0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

I found the problem. Turns out that in the Main App's local.meta, it had [views/Phone...] stanzas that overrode the ones in the CCM's default.meta. Not sure how they got there, but once I removed them the views showed up.

View solution in original post

0 Karma

David
Splunk Employee
Splunk Employee

I found the problem. Turns out that in the Main App's local.meta, it had [views/Phone...] stanzas that overrode the ones in the CCM's default.meta. Not sure how they got there, but once I removed them the views showed up.

0 Karma

David
Splunk Employee
Splunk Employee

They're definitely not anywhere private. They're all stored in /opt/splunk/etc/apps/CCM/default/data/ui/views:

splunktest:/opt/splunk/etc # egrep -R Forecasting .
./users/dveuve/CCM/local/viewstates.conf:[PhoneForecastingDashboardAdvanced:_current]
./users/dveuve/CCM/local/viewstates.conf:[PhoneForecastingDashboard:_current]
./apps/CCM/metadata/default.meta:[views/PhoneForecastingDashboard]
./apps/CCM/default/data/ui/nav/default.xml:    <view name="PhoneForecastingDashboard" />
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml:  <label>Forecasting Dashboard</label>
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml:      <h1>Forecasting Dashboard</h1>
./apps/AdBrite/default/data/ui/nav/default.xml:      <view name="PhoneForecastingDashboard" />
splunktest:/opt/splunk/etc # find . -type f -name "PhoneForecasting*"
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml

(Above showing all the files that reference the view label, and then more specifically, the location of the file for that view.)

Additionally, when I browse to the manage views page (/en-US/manager/CCM/data/ui/views), all the views are listed, and all show Global. Under permissions, they all say "Everyone: Read" and "Views Should Appear In: All Apps."

I'm assuming it's just something that I've got wrong, but I'm not sure what it is.

0 Karma

araitz
Splunk Employee
Splunk Employee

My guess is that you have saved your views and/or nav as 'private', meaning that they live in $SPLUNK_HOME/etc/users///local/... or somewhere similar.

By design, those views/nav will not be accessible by anyone else but you.

Ensure that you have shared out the nav and views at at least the app level (if not the global level).

0 Karma

David
Splunk Employee
Splunk Employee

Responded via an answer, so that I could provide a more full response.

0 Karma

Genti
Splunk Employee
Splunk Employee

perhaps try adding:

access = read : [ * ], write : [ admin ]

to your [] stanzas

0 Karma

David
Splunk Employee
Splunk Employee

No luck. So here is one other oddity. There is one view, which does show up, called "PhoneForecastingDashboard." But I have no explanation for why that one does show up. I did an egrep -R PhoneForecastingDashboard /opt/splunk/etc and the only hits came up were in default.xml (where it has the exact same syntax as the above) and in default.meta (where it has the exact same syntax as the above). So something does work.. but I don't know why.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...