Dashboards & Visualizations
Highlighted

How to get a deleted dashboard to stop sending daily email reports?

SplunkTrust
SplunkTrust

I created a dashboard about 2 years ago which will send a daily report titled Status Codes.. I'm pretty sure I deleted this dashboard about a year ago, but for some reason it's still emailing us the report. When I click the 'View Dashboard' link in the email, it will give me a page not found because the dashboard no longer exists. I've looked everywhere for this dashboard and how to have it stop sending emails. Any idea how I can get this non-existent dashboard to stop sending us emails each day?

Tags (3)
0 Karma
Highlighted

Re: How to get a deleted dashboard to stop sending daily email reports?

SplunkTrust
SplunkTrust

Hi stoelpin,

this sounds like some report rather than a dashboard. To find this saved search you can run this rest search on your search head (if you have only one SH) or on your SH's (if you have multiple) or on your SHC captain (if you have a SHC):

 | rest /servicesNS/-/-/saved/searches/ | where is_scheduled=1 AND 'action.email'=1 | table eai:acl.app title

This will return all saved searches that are scheduled and are setup to send an email.

If you still cannot find the saved search, check the scheduler log for the name or SID and also check the splunk logs to find the sender of this email.

Hope this helps ...

View solution in original post

Highlighted

Re: How to get a deleted dashboard to stop sending daily email reports?

SplunkTrust
SplunkTrust

Worked perfectly, thanks!

0 Karma
Highlighted

Re: How to get a deleted dashboard to stop sending daily email reports?

Engager

This explained how to find it, but how do I delete it?

0 Karma
Highlighted

Re: How to get a deleted dashboard to stop sending daily email reports?

SplunkTrust
SplunkTrust

Once you have identified the report / saved search you can

Hope this helps ...

cheers, MuS

0 Karma