Is there a way to restore a deleted dashboard?

[kualo]

Hi,

I accidentally deleted a dashboard.
Is there any way to bring it back?

[sbrice17]

Yes, you can search the index="_internal" "dashboard name" or keyword "purgeEligible" Remember this will be dependent on your _internal retention policy. Go through the events and you will find the xml event with the dashboard information.

[eugenek]

I just had to do this for a report, and was able to find the query in the audit log (index=_audit). That may get you part way there.

[rjthibod]

I am pretty sure the answer is no. You would want to check the "local" folder (on disk) of the app the dashboard belonged to, or check the user account folder for the username that created the dashboard. The latter is under SPLUNK_ROOT/etc/users/USER_NAME

If you remember the name of the dashboard url, you could also search the disk for that name with the .xml extension just to be double-sure.