Installation

Why am I unable to delete default reports from custom app in Splunk Cloud?

daveywfii
Explorer

I created a custom app and used the built in template that adds a bunch of generic reports and dashboards. I am unable to delete any of the saved reports that came default with the template. I am getting this error: 

 

 

 

This saved search failed to handle removal request due to Object id=Histogram of delay in seconds cannot be deleted in config=savedsearches.

 

 

 

 

Any ideas how I can delete these? I am getting duplicate errors on our ES SH because of using this template multiple times. I have tried disabling the reports, but it still doesn't work. I have tried to delete from the Settings > "Searches, Reports, and Alerts" as well as within the app and neither worked.  

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @daveywfii ,

you can use the solution from @richgalloway or open a ticket to Splunk Support for removal.

Ciao.

Giuseppe

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If the object is in the default directory of the app then it cannot be deleted via the UI.  It has to be removed off-line and the app re-packaged and re-installed.  If you don't have an off-line copy of the app, ask Support for one.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...