Can not modify permissions on ScheduledView (PDF Scheduling) object.


I created a simple dashboard as PDF delivery schedule and it wrote it to the savedsearches.conf in my user folder.

But I need it to part of the app so I can deploy it to another search head.

When I try to change the permissions from /manager/permissions/myapp/scheduled/views/ I get the following error

Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

splunkd.log says

-0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications

How do I fix this? What are these error messages referring to?

Splunk Employee
Splunk Employee

Some of what you're describing is kind of "out of sync".
If you created a simple dashboard with a PDF delivery schedule... it would, by default have been saved to your user folder. So I'm not sure what you mean when you say you "wrote it to savedseraches.conf in your user folder".
Do you mean you copied it from one place to another? Because it would have already been there.

Also... I'm not seeing (nor am I familiar with ) the path you're mentioning. (So I'm wondering if you are on some version that is just before my time).

So probably... we shouldn't worry about unscrewing what has been twisted, in order to get your Dashboard functioning the way you need it to.

Best way out of this... rather than trying to undo whatever you've done on the command line... is to re-create your dashboard, schedule it and then change the permissions through the GUI. If you don't have access to edit the dashboard anymore as a result of whatever it is that's going on... the xml file should still be in your
$SPLUNK_HOME/etc/users/local/data/ui/views/ directory...
Create a new dashboard. Edit Source, Copy the contents of the xml file to the source window and save.
Then schedule the PDF delivery.
Then... you can navigate to the list of views either by clicking on the 'Dashboards' menu item in current releases or navigating to the list via the Settings menu in current releases or the Manager menu in previous releases... and move the dashboard or copy or clone it to the app you want to own it... then change the permissions to APP ONLY.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma


Thanks for the response! I should have been more clear; the path I was referring to is a URL on web interface. More specifically: https://splunkserver.tld/en-US/manager/myapp/scheduled/views aka Settings > User interface > View PDF scheduling

From that page I select Permissions and select This app only and get the 409 error above.

All of this happened in UI, none from CLI. I know I can manually move the stanza to the app's savedsearches.conf but it would be nice if I could figure out what was wrong with the UI actions.

Any other ideas?

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...