Unable to delete dashboards in an app

[ww9rivers]

This seems to be a bit strange: We are running Enterprise version 8.1.5 in a search head cluster. A custom app is created for our security team to manage their dashboards, etc.

The strange thing is, some of the dashboards cannot be deleted -- there is just no delete (or move) option:

I've checked on all the individual nodes in the cluster, they are all in the local/ folder in the app.

This is on-prem Splunk Enterprise, so I can manually delete them from all the nodes as an admin. But I would like to understand what I am missing here.

I did search for answers here and found this one post. But that is in the Splunk Cloud. So I am not sure if my issue is a bug like that in the posting or not.

Thanks for any thoughts / discussions. Happy holidays!

[isoutamo]

Have you checked that you haven’t those on deployer?

[ww9rivers]

I did not check that.

I just checked now. All the six dashboards are found on the deployer, also in the local/ folder (I guess it is desired for this app to always be editable by the security team.) -- Furthermore, there are more dashboards on the deployer. The team is cleaning up the app. It seems that they have been able to delete most of what they want to delete.

By the way, I have also checked and double checked the permissions on all the dashboards. They all have "write" permission granted to the admin role.

[isoutamo]

If those dashboards are deployed by deployer you cannot delete those from SHC node. Only those dashboards which you have directly created on SHC node you can delete unless you later add those to deploy via deployer.

Currently there are several ways how deployer push those KOs from Deployer to SHC nodes. See that from Choose a deployer push mode

r. Ismo

[ww9rivers]

In my case, all the 6 dashboards currently in the local/ folder all exist in the deployer, so they have been deployed at some point. Why only two of them have the "Move" and "Delete" options?

I guess my ultimate question is: What makes the search head cluster nodes decide which dashboards can be deleted and not the others?