How to get a deleted dashboard to stop sending daily email reports?

[skoelpin]

I created a dashboard about 2 years ago which will send a daily report titled Status Codes.. I'm pretty sure I deleted this dashboard about a year ago, but for some reason it's still emailing us the report. When I click the 'View Dashboard' link in the email, it will give me a page not found because the dashboard no longer exists. I've looked everywhere for this dashboard and how to have it stop sending emails. Any idea how I can get this non-existent dashboard to stop sending us emails each day?

[MuS · Accepted solution]

Hi stoelpin,

this sounds like some report rather than a dashboard. To find this saved search you can run this rest search on your search head (if you have only one SH) or on your SH's (if you have multiple) or on your SHC captain (if you have a SHC):

 | rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title

This will return all saved searches that are scheduled and are setup to send an email.

If you still cannot find the saved search, check the scheduler log for the name or SID and also check the splunk logs to find the sender of this email.

Hope this helps ...

[skoelpin]

Worked perfectly, thanks!

[ers81239]

This explained how to find it, but how do I delete it?

[MuS]

Once you have identified the report / saved search you can

• delete it using the UI http[s]://yourservernamehere:[yourporthere]/[yourlocale-here]/manager/search/saved/searches on the server where it is saved
• use the CLI REST call methods mentioned in this answer https://answers.splunk.com/answers/66880/deleting-several-saved-searches-in-one-call.html
• edit the savedsearches.conf file on the Splunk instance running the saved search.

Hope this helps ...

cheers, MuS