Unable to delete dashboards in an app

[ww9rivers]

This seems to be a bit strange: We are running Enterprise version 8.1.5 in a search head cluster. A custom app is created for our security team to manage their dashboards, etc.

The strange thing is, some of the dashboards cannot be deleted -- there is just no delete (or move) option:

I've checked on all the individual nodes in the cluster, they are all in the local/ folder in the app.

This is on-prem Splunk Enterprise, so I can manually delete them from all the nodes as an admin. But I would like to understand what I am missing here.

I did search for answers here and found this one post. But that is in the Splunk Cloud. So I am not sure if my issue is a bug like that in the posting or not.

Thanks for any thoughts / discussions. Happy holidays!

[bayuste]

The presence of a dashboard in the default directory tree removes the delete option from Settings > User Interface > Views interface.

You can use Settings -> User Interface > Views to (1) delete private dashboards in the user directory tree; and (2) to delete a shared dashboard in the app local directory tree as long as there is not another copy of the dashboard in the default directory tree.

Dashboards end up in the default directory tree on a search head cluster via deployment from a search head deployer. Dashboards also commonly reside in the default directory tree on stand alone search heads in apps installed directly from Splunkbase.

Edit one of these default dashboards in the GUI, and it will be saved in the local directory tree. But the original copy of the dashboard in default will remove the delete option from Settings > User Interface > Views. The default dashboards can only be deleted manually from the filesystem.

[isoutamo]

Have you checked that you haven’t those on deployer?

[ww9rivers]

I did not check that.

I just checked now. All the six dashboards are found on the deployer, also in the local/ folder (I guess it is desired for this app to always be editable by the security team.) -- Furthermore, there are more dashboards on the deployer. The team is cleaning up the app. It seems that they have been able to delete most of what they want to delete.

By the way, I have also checked and double checked the permissions on all the dashboards. They all have "write" permission granted to the admin role.

[isoutamo]

If those dashboards are deployed by deployer you cannot delete those from SHC node. Only those dashboards which you have directly created on SHC node you can delete unless you later add those to deploy via deployer.

Currently there are several ways how deployer push those KOs from Deployer to SHC nodes. See that from Choose a deployer push mode

r. Ismo

[ww9rivers]

In my case, all the 6 dashboards currently in the local/ folder all exist in the deployer, so they have been deployed at some point. Why only two of them have the "Move" and "Delete" options?

I guess my ultimate question is: What makes the search head cluster nodes decide which dashboards can be deleted and not the others?