Reporting

Missing Reports

marcxbrl
Explorer

A couple days ago I had to force-restart my splunk server. After i restarted it my logs and searches worked fine. However my (and other users) saved searches have dissappeared. In most cases they've just completely disappeared off the list. But there's a couple under the dashboard where the title is showing but when you click on them you get:

Configuration error - we were not able to find a saved search called 'Custom Report last 30 days'.

Is there any way to recover these? What directory are the reports saved in?

Tags (1)
1 Solution

emiller42
Motivator

Saved searches can be stored in a couple of places. If the search is private to the user, then it would be under:

$SPLUNK_HOME/etc/users/USERNAME/APPNAME/local/savedsearches.conf

If it's a saved search that's shared, then it gets moved into the app itself:

$SPLUNK_HOME/etc/apps/APPNAME/local/savedsearches.conf

Look in these places for the missing content. These are what you'd want to restore from a backup to correct any corruption or missing configurations.

View solution in original post

emiller42
Motivator

Saved searches can be stored in a couple of places. If the search is private to the user, then it would be under:

$SPLUNK_HOME/etc/users/USERNAME/APPNAME/local/savedsearches.conf

If it's a saved search that's shared, then it gets moved into the app itself:

$SPLUNK_HOME/etc/apps/APPNAME/local/savedsearches.conf

Look in these places for the missing content. These are what you'd want to restore from a backup to correct any corruption or missing configurations.

marcxbrl
Explorer

Thank you. I looked at those files and they had the wrong permissions on them. Strangest thing... only the saved search files had the wrong permissions.

After correcting that the custom searches display correctly.

0 Karma

melting
Splunk Employee
Splunk Employee

searched are save in searches.conf in several places in the $PLUNK_HOME/etc perhaps you can check there. Also you can see in manager including permissions.

Any more info is welcome. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...