Dashboards & Visualizations

How to change the ownership of dashboards to a specific user in the system?

athorat
Communicator

So we had to move dashboards from the Search app to Respective Project apps.
Using the steps available from forums, we copied the files from the Local directory under the Search App and used that under a specific app.
We did not restart Splunk when we did the change, so the dashboards were not reflecting immediately I guess. So now all of a sudden we see those dashboards under the app, but the ownership shows nobody.

How do we change the ownership of the dashboards to a specific user in the system?

Tags (3)
1 Solution

somesoni2
Revered Legend

The permissions and scope of the Splunk objects are defined in the .meta files. Typically there will be an entry in the local.meta file in the /etc/apps/App_Name/metadata folder which will define who is the owner, scope (This app/All Apps) of the object and access permission. A typical entry in local.meta looks like below

[view/error_lookup]
access = read : [ * ], write : [ admin ]
export = system
owner = admin

When you copied the dashboard from Search app to individual apps, copy the local.meta entries for those dashboards into the corresponding apps as well.

View solution in original post

somesoni2
Revered Legend

The permissions and scope of the Splunk objects are defined in the .meta files. Typically there will be an entry in the local.meta file in the /etc/apps/App_Name/metadata folder which will define who is the owner, scope (This app/All Apps) of the object and access permission. A typical entry in local.meta looks like below

[view/error_lookup]
access = read : [ * ], write : [ admin ]
export = system
owner = admin

When you copied the dashboard from Search app to individual apps, copy the local.meta entries for those dashboards into the corresponding apps as well.

athorat
Communicator

Hi Some

I did copy all the files from the local of search app.
That file shows the entries for views and lookup permissions.
Does it have to do anything with restart? We had not stopped splunk when we copied the files over.
As I mentioned earlier the dashboard were not visible till today since we copied the files yesterday afternoon.

Do you think of any other reason?

Thanks (Y)

0 Karma

rahulroy_splunk
Path Finder

You can just get away with refreshing the endpoints. https://yoursplunkserver/debug/refresh

athorat
Communicator

Awesome.
debug/refresh works.
Earlier the reports and alerts were not showing up and it does now.
Three Birds in a stone.

Thanks,
Anil.

0 Karma

bruce845
Explorer

You can try moving this files of dashbords:

From:
etc/apps/app/local/data

To:
etc/users/user/app/local/data

After, you going to adjust the permissions.

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...