Missing Reports

[marcxbrl]

A couple days ago I had to force-restart my splunk server. After i restarted it my logs and searches worked fine. However my (and other users) saved searches have dissappeared. In most cases they've just completely disappeared off the list. But there's a couple under the dashboard where the title is showing but when you click on them you get:

Configuration error - we were not able to find a saved search called 'Custom Report last 30 days'.

Is there any way to recover these? What directory are the reports saved in?

[emiller42 · Accepted solution]

Saved searches can be stored in a couple of places. If the search is private to the user, then it would be under:

$SPLUNK_HOME/etc/users/USERNAME/APPNAME/local/savedsearches.conf

If it's a saved search that's shared, then it gets moved into the app itself:

$SPLUNK_HOME/etc/apps/APPNAME/local/savedsearches.conf

Look in these places for the missing content. These are what you'd want to restore from a backup to correct any corruption or missing configurations.

[marcxbrl]

Thank you. I looked at those files and they had the wrong permissions on them. Strangest thing... only the saved search files had the wrong permissions.

After correcting that the custom searches display correctly.

[melting]

searched are save in searches.conf in several places in the $PLUNK_HOME/etc perhaps you can check there. Also you can see in manager including permissions.

Any more info is welcome. Thanks!