Can not modify permissions on ScheduledView (PDF Scheduling) object.

[neiljpeterson]

I created a simple dashboard as PDF delivery schedule and it wrote it to the savedsearches.conf in my user folder.

But I need it to part of the app so I can deploy it to another search head.

When I try to change the permissions from /manager/permissions/myapp/scheduled/views/ I get the following error

Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

splunkd.log says

-0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications

How do I fix this? What are these error messages referring to?

[rsennett_splunk]

Some of what you're describing is kind of "out of sync".
If you created a simple dashboard with a PDF delivery schedule... it would, by default have been saved to your user folder. So I'm not sure what you mean when you say you "wrote it to savedseraches.conf in your user folder".
Do you mean you copied it from one place to another? Because it would have already been there.

Also... I'm not seeing (nor am I familiar with ) the path you're mentioning. (So I'm wondering if you are on some version that is just before my time).

So probably... we shouldn't worry about unscrewing what has been twisted, in order to get your Dashboard functioning the way you need it to.

Best way out of this... rather than trying to undo whatever you've done on the command line... is to re-create your dashboard, schedule it and then change the permissions through the GUI. If you don't have access to edit the dashboard anymore as a result of whatever it is that's going on... the xml file should still be in your
$SPLUNK_HOME/etc/users/local/data/ui/views/ directory...
Create a new dashboard. Edit Source, Copy the contents of the xml file to the source window and save.
Then schedule the PDF delivery.
Then... you can navigate to the list of views either by clicking on the 'Dashboards' menu item in current releases or navigating to the list via the Settings menu in current releases or the Manager menu in previous releases... and move the dashboard or copy or clone it to the app you want to own it... then change the permissions to APP ONLY.

[neiljpeterson]

Thanks for the response! I should have been more clear; the path I was referring to is a URL on web interface. More specifically: https://splunkserver.tld/en-US/manager/myapp/scheduled/views aka Settings > User interface > View PDF scheduling

From that page I select Permissions and select This app only and get the 409 error above.

All of this happened in UI, none from CLI. I know I can manually move the stanza to the app's savedsearches.conf but it would be nice if I could figure out what was wrong with the UI actions.

Any other ideas?