Dashboards & Visualizations

Is there a way to restore a deleted dashboard?



I accidentally deleted a dashboard.
Is there any way to bring it back?


Yes, you can search the index="_internal" "dashboard name" or keyword "purgeEligible" Remember this will be dependent on your _internal retention policy. Go through the events and you will find the xml event with the dashboard information.

0 Karma

Path Finder

I just had to do this for a report, and was able to find the query in the audit log (index=_audit). That may get you part way there.

0 Karma


I am pretty sure the answer is no. You would want to check the "local" folder (on disk) of the app the dashboard belonged to, or check the user account folder for the username that created the dashboard. The latter is under SPLUNK_ROOT/etc/users/USER_NAME

If you remember the name of the dashboard url, you could also search the disk for that name with the .xml extension just to be double-sure.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...