How to change the ownership of dashboards to a specific user in the system?

[athorat]

So we had to move dashboards from the Search app to Respective Project apps.
Using the steps available from forums, we copied the files from the Local directory under the Search App and used that under a specific app.
We did not restart Splunk when we did the change, so the dashboards were not reflecting immediately I guess. So now all of a sudden we see those dashboards under the app, but the ownership shows nobody.

How do we change the ownership of the dashboards to a specific user in the system?

[somesoni2 · Accepted solution]

The permissions and scope of the Splunk objects are defined in the .meta files. Typically there will be an entry in the local.meta file in the /etc/apps/App_Name/metadata folder which will define who is the owner, scope (This app/All Apps) of the object and access permission. A typical entry in local.meta looks like below

[view/error_lookup]
access = read : [ * ], write : [ admin ]
export = system
owner = admin

When you copied the dashboard from Search app to individual apps, copy the local.meta entries for those dashboards into the corresponding apps as well.

[athorat]

Hi Some

I did copy all the files from the local of search app.
That file shows the entries for views and lookup permissions.
Does it have to do anything with restart? We had not stopped splunk when we copied the files over.
As I mentioned earlier the dashboard were not visible till today since we copied the files yesterday afternoon.

Do you think of any other reason?

Thanks (Y)

[rahulroy_splunk]

You can just get away with refreshing the endpoints. https://yoursplunkserver/debug/refresh

[athorat]

Awesome.
debug/refresh works.
Earlier the reports and alerts were not showing up and it does now.
Three Birds in a stone.

Thanks,
Anil.

[bruce845]

You can try moving this files of dashbords:

From:
etc/apps/app/local/data

To:
etc/users/user/app/local/data

After, you going to adjust the permissions.