Dashboard display could not find object id= after migrating in 7.2.3

[sebgirardlux]

I've upgrade Splunk Enterprise in 7.2.3, everything went well. I opened the dashboard and have on most of my dashboard the message could not find object id= ....
I have all the rights and honestly I'm stuck, does anyone can help?
Thanks

[dkeck · Accepted solution]

Hi,

are you able to create new dashboards?

There was a bug in earlier 6.x versions where users couldn´t create dashboards with error like you have. Might be related?!

[sebgirardlux]

Hi,

yes I'm able to create dashboard.
I think it is related with the scheduled reports but I do not understand.
I used to created my dashboard with reports but I don't find my report since the upgrade...

[CustomerX Deep Security Malware Event]
action.email.useNSSubject = 1
alert.track = 0
dispatch.earliest_time = -30d@d
dispatch.latest_time = now
display.events.fields = ["host","source","sourcetype","Domain","cef_severity"]
display.general.type = visualizations
display.page.search.mode = verbose
display.page.search.tab = visualizations
display.statistics.show = 0
display.visualizations.charting.chart.stackMode = stacked
display.visualizations.charting.chart.style = minimal
request.ui_dispatch_app = search
request.ui_dispatch_view = search
search = index=xxx_antimalware product="Deep Security Manager" cef_rulename="Alert Started" msg="Alert: Anti-Malware Alert*" "customerX_*" | timechart count by target

[dkeck]

Ok if you can´t find objects after a splunk upgrade thats sounds like they where somehow created in default before the update?? This would explain why they are missing now. Default is overwritten after an upgrade

[sebgirardlux]

well i have to recreate the daashboard then... 😞

[dkeck]

I would be happy if you could accept and upvote the answer 🙂

[dkeck]

sry to hear that, but you are not suppost to create objects in default. Always use local.

Maybe you backup your splunk folder somewhere with your server backup? maybe you can find them there.