Dashboards & Visualizations
Highlighted

Is there a way to restore a deleted dashboard?

Explorer

Hi,

I accidentally deleted a dashboard.
Is there any way to bring it back?

Highlighted

Re: Is there a way to restore a deleted dashboard?

Champion

I am pretty sure the answer is no. You would want to check the "local" folder (on disk) of the app the dashboard belonged to, or check the user account folder for the username that created the dashboard. The latter is under SPLUNKROOT/etc/users/USERNAME

If you remember the name of the dashboard url, you could also search the disk for that name with the .xml extension just to be double-sure.

0 Karma
Highlighted

Re: Is there a way to restore a deleted dashboard?

Path Finder

I just had to do this for a report, and was able to find the query in the audit log (index=_audit). That may get you part way there.

0 Karma
Highlighted

Re: Is there a way to restore a deleted dashboard?

Explorer

Yes, you can search the index="_internal" "dashboard name" or keyword "purgeEligible" Remember this will be dependent on your _internal retention policy. Go through the events and you will find the xml event with the dashboard information.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.