Can not modify permissions on ScheduledView (PDF Scheduling) object.


I created a simple dashboard as PDF delivery schedule and it wrote it to the savedsearches.conf in my user folder.

But I need it to part of the app so I can deploy it to another search head.

When I try to change the permissions from /manager/permissions/myapp/scheduled/views/ I get the following error

Splunk could not update permissions for resource scheduled/views [HTTP 409] [{'text': 'Cannot overwrite existing app object', 'code': None, 'type': 'ERROR'}]

splunkd.log says

-0500 ERROR SavedSearchAdminHandler - Cannot edit/create a saved search for wildcarded users or applications

How do I fix this? What are these error messages referring to?

Splunk Employee
Splunk Employee

Some of what you're describing is kind of "out of sync".
If you created a simple dashboard with a PDF delivery schedule... it would, by default have been saved to your user folder. So I'm not sure what you mean when you say you "wrote it to savedseraches.conf in your user folder".
Do you mean you copied it from one place to another? Because it would have already been there.

Also... I'm not seeing (nor am I familiar with ) the path you're mentioning. (So I'm wondering if you are on some version that is just before my time).

So probably... we shouldn't worry about unscrewing what has been twisted, in order to get your Dashboard functioning the way you need it to.

Best way out of this... rather than trying to undo whatever you've done on the command line... is to re-create your dashboard, schedule it and then change the permissions through the GUI. If you don't have access to edit the dashboard anymore as a result of whatever it is that's going on... the xml file should still be in your
$SPLUNK_HOME/etc/users/local/data/ui/views/ directory...
Create a new dashboard. Edit Source, Copy the contents of the xml file to the source window and save.
Then schedule the PDF delivery.
Then... you can navigate to the list of views either by clicking on the 'Dashboards' menu item in current releases or navigating to the list via the Settings menu in current releases or the Manager menu in previous releases... and move the dashboard or copy or clone it to the app you want to own it... then change the permissions to APP ONLY.

With Splunk... the answer is always "YES!". It just might require more regex than you're prepared for!
0 Karma


Thanks for the response! I should have been more clear; the path I was referring to is a URL on web interface. More specifically: https://splunkserver.tld/en-US/manager/myapp/scheduled/views aka Settings > User interface > View PDF scheduling

From that page I select Permissions and select This app only and get the 409 error above.

All of this happened in UI, none from CLI. I know I can manually move the stanza to the app's savedsearches.conf but it would be nice if I could figure out what was wrong with the UI actions.

Any other ideas?

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...