Splunk Enterprise Security: Adding objects to data model caused dashboards to show invalid data. Is there a way to return the data model to its "original" setup?

[srunyon]

I added several objects to the "Vulnerabilities" data model. After that the Enterprise Security /Security Domains/Network/Vulnerability Center dashboard started showing inconsistent values in some panels and has "search is waiting for input" on other panels. Is there a way to return the data model and the dashboard to the original configuration before I screwed them up?

[mdessus_splunk · Accepted solution]

On way to do it is to go to your Splunk home directory and delete the custom files:

• /opt/splunk/etc/apps/Splunk_SA_CIM/default/data/models/xxx.json for datamodel
• /opt/splunk/etc/apps/xxx/local/data/ui/views/yyy.xml (or etc/users/ if they are private) for dashboards (you may use the find command if you do not know the apps they are belong too).

And you need to restart Splunk after.

[srunyon]

Deleting the files and restarting restored the items. Thanks for the help.