Security

How do I get the settings menu back in Splunk Web?

techn0gichida
Explorer

The settings dropdown menu only shows the DMC? I don't how it got this way. I was trying to restore some views on reports and ran the refresh options for nav and view.

alt text

Labels (1)
1 Solution

sideview
SplunkTrust
SplunkTrust

Very interesting. It is not widely known but the admin section is actually extremely dynamic, and is controlled in large part by all the XML files you'll find in etc/apps/search/default/data/ui/manager/ The files there are a part of EAI, which stands for Extensible Administration Interface, and the "eai" prefix that you see in certain places in the rest api still. It is indeed extensible, and you can see some apps like DBConnect do indeed extend it quite powerfully.

Also the refresh endpoints I believe are able to refresh those XML files from disk. It's possible that Splunk was unable to reach those files at the moment when you hit the refresh endpoint? Perhaps verify that all those xml files are actually there in the right place and hit the refresh endpoint again ?

View solution in original post

sideview
SplunkTrust
SplunkTrust

Very interesting. It is not widely known but the admin section is actually extremely dynamic, and is controlled in large part by all the XML files you'll find in etc/apps/search/default/data/ui/manager/ The files there are a part of EAI, which stands for Extensible Administration Interface, and the "eai" prefix that you see in certain places in the rest api still. It is indeed extensible, and you can see some apps like DBConnect do indeed extend it quite powerfully.

Also the refresh endpoints I believe are able to refresh those XML files from disk. It's possible that Splunk was unable to reach those files at the moment when you hit the refresh endpoint? Perhaps verify that all those xml files are actually there in the right place and hit the refresh endpoint again ?

techn0gichida
Explorer

I did find that the entire default directory was missing. I've restored from fresh install of the same Splunk version.

Are http://splunk/en-US/debug/refresh?entity=/data/ui/nav and http://splunk/en-US/debug/refresh?entity=/data/ui/view the correct endpoint to refresh?

Thanks,
Jim

0 Karma

sideview
SplunkTrust
SplunkTrust

Great - I believe the relevant refresh endpoint is actually http://splunk/en-US/debug/refresh?entity=/admin/manager

/data/ui/nav refreshes all the */data/ui/nav/default.xml files from all apps.

/data/ui/views refreshes all the */data/ui/views/*.xml from all apps.

When in doubt, you can just hit the refresh endpoint with no entity specified and it can take a really long time on some platforms, but it will refresh them all.

ridwanahmed
Path Finder

if I'm going to http://mySplunk:8000/en-US/debug/refresh?entity=/data/ui/view, suggestions on where to look next? I've checked all the files in /etc/apps/search/.../views/manager are have 644 permissions, owned by splunk.

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<response>
<link type="text/css" id="dark-mode" rel="stylesheet" href=""/>
<style type="text/css" id="dark-mode-custom-style"/>
<messages>
<msg type="ERROR">Forbidden</msg>
</messages>
</response>
0 Karma

sideview
SplunkTrust
SplunkTrust

Ah thanks - sorry there was a typo in my response. The URL is
http://splunk/en-US/debug/refresh?entity=/data/ui/views

and it was missing the "s" on the end, which is why you were getting that error. Add the "s" and it will work. Also I will go and edit my comment above to fix that typo.

0 Karma

techn0gichida
Explorer

Thank you very. This did bring back the all the settings. Hate to be a bother but can you tell me how I get the files in /etc/apps/search/local/data/ui/views to be seen? I don't see the dashboards.

Thanks,
Jim

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

Hi @techn0gichida - If @sideview was able to answer your question, please don't forget to resolve the post by clicking "Accept" below the answer. Thank you!

0 Karma

sideview
SplunkTrust
SplunkTrust

No problem - just hit http://splunk/en-US/debug/refresh?entity=/data/ui/views and that will refresh all the views aka dashboards.

0 Karma

techn0gichida
Explorer

I did that refresh but dashboards in the location still do not show up. Maybe if I move them to another location it might pick them up?

Thanks,
Jim

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...