I have a Splunk App created. Which has in App access permission. There are various dashboards in the App, and Dashboards have different panels.
Whenever i open the same dashboards i see different sets of panels and when the person who has created opens he see's different set of panels for the same dashboard.
i.e for the same dashboard, different users see different version. Can any one help me what exactly would be the issue.
I suspect it is permission related issue, but how same dashboard is shown differently. If it would have been permission related then the user who do not have access should not be able to see the dashboard itself rather than showing different versions.
First, are you running Splunk in a Search-Head cluster, or is this a standalone search head?
If you are running in a search-head cluster, you probably want to make sure your knowledge bundles are properly syncing between members. You will need to dig into DMC/MC for this.
Otherwise, it is likely due to local changes that are user-specific and hidden in a user's local folder, not the app's local folder. If you have access to the search head, look in
$SPLUNK_HOME/etc/users/<USERNAME>/<APP_NAME>/... to see if there is a copy of the dashboard XML file inside the tree under that folder. If there are different versions of the dashboard XML in the users' folders, then that very well could explain it. If this is the case, then you would need to decide what is the most authoritative copy everyone should see. If the desirable copy is the one originally packaged in the app, then you need to do some work to remove the local copies. Otherwise, it is best to move the most authoritative local copy to the local folder in the app,
Perfect, the files were found in the local folder of the user rather than the app folder and hence the issue.
Thanks for answering.
But can you highlight why did this happened? Where exactly is the issue that is causing the dashboards created by user to be stored in his local folder rather than app's folder?
It has to do with permissions. When you look at the permissions in Splunk, it will say if something is shared in all of splunk, just in the app, or just for the user. Depending on how user creates/edits a dashboard will determine the default permissions.