I created a dashboard about 2 years ago which will send a daily report titled Status Codes
.. I'm pretty sure I deleted this dashboard about a year ago, but for some reason it's still emailing us the report. When I click the 'View Dashboard' link in the email, it will give me a page not found
because the dashboard no longer exists. I've looked everywhere for this dashboard and how to have it stop sending emails. Any idea how I can get this non-existent dashboard to stop sending us emails each day?
Hi stoelpin,
this sounds like some report rather than a dashboard. To find this saved search you can run this rest search on your search head (if you have only one SH) or on your SH's (if you have multiple) or on your SHC captain (if you have a SHC):
| rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title
This will return all saved searches that are scheduled and are setup to send an email.
If you still cannot find the saved search, check the scheduler log for the name or SID and also check the splunk logs to find the sender of this email.
Hope this helps ...
Hi stoelpin,
this sounds like some report rather than a dashboard. To find this saved search you can run this rest search on your search head (if you have only one SH) or on your SH's (if you have multiple) or on your SHC captain (if you have a SHC):
| rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title
This will return all saved searches that are scheduled and are setup to send an email.
If you still cannot find the saved search, check the scheduler log for the name or SID and also check the splunk logs to find the sender of this email.
Hope this helps ...
Worked perfectly, thanks!
This explained how to find it, but how do I delete it?
Once you have identified the report / saved search you can
http[s]://yourservernamehere:[yourporthere]/[yourlocale-here]/manager/search/saved/searches
on the server where it is saved savedsearches.conf
file on the Splunk instance running the saved search.Hope this helps ...
cheers, MuS