Monitoring Splunk

How to check who deleted the dashboard?

Mkkk
Engager

Why there is no results when I search index=_internal?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Most typical reason for no results when searching the _internal index, assuming that you search within a retention period, is that your user does not have access to that index (which isn't surprising if you're not an admin).

Mkkk
Engager

Just find that _internal is disabled in the index.  

0 Karma

PickleRick
SplunkTrust
SplunkTrust

What do you mean by that?

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

I think he meant, _internal index was not searchable by the user. That was his issue.

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

You should have an entry in _internal index as below. (In my case dashboard name was "new".)

VatsalJagani_0-1686028436506.png

 

I'm using Splunk version 9.0.4.

 

If this helps, kindly upvote!!!

 

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...