- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So we had to move dashboards from the Search app to Respective Project apps.
Using the steps available from forums, we copied the files from the Local directory under the Search App and used that under a specific app.
We did not restart Splunk when we did the change, so the dashboards were not reflecting immediately I guess. So now all of a sudden we see those dashboards under the app, but the ownership shows nobody.
How do we change the ownership of the dashboards to a specific user in the system?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The permissions and scope of the Splunk objects are defined in the .meta
files. Typically there will be an entry in the local.meta
file in the /etc/apps/App_Name/metadata
folder which will define who is the owner, scope (This app/All Apps) of the object and access permission. A typical entry in local.meta looks like below
[view/error_lookup]
access = read : [ * ], write : [ admin ]
export = system
owner = admin
When you copied the dashboard from Search app to individual apps, copy the local.meta entries for those dashboards into the corresponding apps as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The permissions and scope of the Splunk objects are defined in the .meta
files. Typically there will be an entry in the local.meta
file in the /etc/apps/App_Name/metadata
folder which will define who is the owner, scope (This app/All Apps) of the object and access permission. A typical entry in local.meta looks like below
[view/error_lookup]
access = read : [ * ], write : [ admin ]
export = system
owner = admin
When you copied the dashboard from Search app to individual apps, copy the local.meta entries for those dashboards into the corresponding apps as well.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Some
I did copy all the files from the local of search app.
That file shows the entries for views and lookup permissions.
Does it have to do anything with restart? We had not stopped splunk when we copied the files over.
As I mentioned earlier the dashboard were not visible till today since we copied the files yesterday afternoon.
Do you think of any other reason?
Thanks (Y)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can just get away with refreshing the endpoints. https://yoursplunkserver/debug/refresh
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Awesome.
debug/refresh works.
Earlier the reports and alerts were not showing up and it does now.
Three Birds in a stone.
Thanks,
Anil.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can try moving this files of dashbords:
From:
etc/apps/app/local/data
To:
etc/users/user/app/local/data
After, you going to adjust the permissions.
