Dashboards & Visualizations

Why does my dashboard no longer appear after adding a XML file under \Splunk\etc\apps\myapp\local\data\ui\views?

Javo222
Path Finder

When creating a dashboard from Splunk Web it appears in the list, and also under \Splunk\etc\apps\myapp\default\data\ui\views or \Splunk\etc\apps\myapp\local\data\ui\views
When adding a xml file under one on these folders, the dashboard doesn't appear in Splunk Web. I tried copy/pasting the one created from Splunk Web to duplicate directly in the folder but same problem.

A refresh using http://localhost:8000/en-US/debug/refresh?entity=data/ui/views or complete refresh doesn't help. Restarting splunk Service either.

It was working before and I'm not sure what I changed ... Any idea?

Tags (2)
0 Karma

markthompson
Builder

@javo222

Dashboards you should create via Splunk Web, even if you just create it and then edit the XML file thats in the folder.

Try creating a blank dashboard and copy/paste your XML in there.

Or if you're trying to reference it it should be in the STATIC folder

0 Karma

Javo222
Path Finder

According to the documentation, I can create an XML file myself and place it in the appropriate folder.
As I mention in a comment below, it seems to be permission related but I can't see what is wrong. I gave access to basically everything to everyone.

0 Karma

sideview
SplunkTrust
SplunkTrust

Since you say it was working before, the most likely answer is that either

a) the XML is now malformed. The easiest and silliest way to check this, is to drag the raw xml file into a web browser. The Browser will try to render it as an XML document and if it's malformed in any way, this will fail.

b) the XML is fine, but some param or attribute about it has become illegal. This causes Splunkweb to log some errors internally, and then refuse to put the dashboard/view into the nav, or render it when someone navigates to the URL manually. There is often a system-wide error that will then show up for all users on other views, but I don't think this is universal for all possible errors that could knock out the view - I think it's possible to have an error that doesn't trigger the big error messages in all views of the app. Searching the _internal index for error, and also the name of the view, would turn up more detail.

0 Karma

Javo222
Path Finder

A) works fine
B) Good tip! I can see ERROR ConfContentsCache - Cannot read: C:\Program Files\Splunk\etc\apps\acs\local\data\ui\views\q2.xml: Access is denied.
Need to figure out what's wrong with the rights now

0 Karma

sideview
SplunkTrust
SplunkTrust

As a guess, the file might be owned by a real user, who has full control, but it is probably missing a separate permissions item for the SYSTEM user, which is what's relevant for Splunk, at least when installed and run with default settings. To avoid this in the future, when you're doing stuff with the views on the filesystem, you can grab an existing file from the same directory and create a copy of it, whose contents you then delete. This way you can almost forget about windows file permissions and ownership issues. 😃

0 Karma

Javo222
Path Finder

Is there a way to:
- reset all default permissions in splunk? Maybe it's stored in a specific file?
- restore all default permissions under the installation files? Without the need to uninstall/reinstall?
If I try to repair the install, it says the wizard ended prematurely because of an error and has not been notified. (version 6.2.2)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...