Dashboards & Visualizations

On Splunk 6.5.1, why am I unable to delete or change "Display for" permissions on migrated dashboards?

rarneson
Explorer

Having a little problem with "old dashboards" we have in our current Search Head Cluster (SHC). All newly created dashboards work just fine.

Where the old dashboards came from is our old Splunk Enterprise Search Head Cluster. I took the existing dashboards off there and put them into our new cluster deployer ($SPLUNK_HOME/etc/shcluster/... clustermaster machine) and redeployed them to the new SHC members.

This all worked fantastic. Or so I thought. A month or two down the line, someone noticed we could no longer delete old dashboards or flip them from "private" to "app" or vice versa. We can edit the contents of the dashboard just fine. I'm trying to do this with the same LDAP user that create them as well as the local Splunk admin user.

Once again, all new dashboards create post "migration" are working great.

So my question is, is there any way to fix these old dashboards? I'm currently on Splunk 6.5.1.

0 Karma
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rarneson,
I think this info in our docs might apply to your situation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

I'm not sure what the workaround might be, though. I'm going to ask around for advice, will post an update when I learn more.

Hope this helps!

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rarneson,
I think this info in our docs might apply to your situation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

I'm not sure what the workaround might be, though. I'm going to ask around for advice, will post an update when I learn more.

Hope this helps!

Steve_G_
Splunk Employee
Splunk Employee

As the cited doc states, "The only way to delete an app-level baseline knowledge object is to redeploy an updated version of the app that does not include the knowledge object." So, that is the workaround.

rarneson
Explorer

Ahh, I was thinking that might be the case since I couldn't seem to find another method. Luckily this is nothing major, just an mild annoyance a user had sent me. I appreciate pointing me to the docs. If there is another workaround other than redeploying I'd love to hear it though.

Have a good one & thanks!

frobinson_splun
Splunk Employee
Splunk Employee

Stay tuned! Hoping to have some additional info in the next couple of days.

0 Karma

rarneson
Explorer

Hi, just checking to see if anyone might have an idea on this one. Thanks!

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...