I created a custom app and used the built in template that adds a bunch of generic reports and dashboards. I am unable to delete any of the saved reports that came default with the template. I am getting this error:
This saved search failed to handle removal request due to Object id=Histogram of delay in seconds cannot be deleted in config=savedsearches.
Any ideas how I can delete these? I am getting duplicate errors on our ES SH because of using this template multiple times. I have tried disabling the reports, but it still doesn't work. I have tried to delete from the Settings > "Searches, Reports, and Alerts" as well as within the app and neither worked.
Hi @daveywfii ,
you can use the solution from @richgalloway or open a ticket to Splunk Support for removal.
Ciao.
Giuseppe
If the object is in the default directory of the app then it cannot be deleted via the UI. It has to be removed off-line and the app re-packaged and re-installed. If you don't have an off-line copy of the app, ask Support for one.