Splunk Search

Where do you manually delete certain reports or dashboards on the server?

Jarohnimo
Builder

So I have mass copied the search app from Server A to Server B (Along with the users directory) to basically copy over all the reports and dashboards.. however now I'd like to delete about 100 reports from Server B. Can someone help me identify the appropriate files to delete while on the server within the directories (C:\program files\splunk\etc......). Say I had a report called: Test, what files do I need to delete from within the server to accomplish this?

0 Karma
1 Solution

somesoni2
Revered Legend

To delete dashboard, you need to delete corresponding .xml files from following locations:

C:\program files\splunk\etc\apps\search\local\data\ui\views  (for dashboards shared in app/global)
                 -You would also need to remove local.meta entry (not the whole file just the corresponding entry from C:\program files\splunk\etc\apps\search\metadata\local.meta file

C:\program files\splunk\etc\users\<usernameHere>\search\local\data\ui\views  (private dashboards)

For reports, you need to delete corresponding entries in the savedsearches.conf files (not the whole file just the corresponding entries) from following locations:

C:\program files\splunk\etc\apps\search\local\savedsearches.conf  (for reports shared in app/global)
                 -You would also need to remove local.meta entry (not the whole file just the corresponding entry from C:\program files\splunk\etc\apps\search\metadata\local.meta file

C:\program files\splunk\etc\users\<usernameHere>\search\local\savedsearches.conf  (private reports)

View solution in original post

0 Karma

somesoni2
Revered Legend

To delete dashboard, you need to delete corresponding .xml files from following locations:

C:\program files\splunk\etc\apps\search\local\data\ui\views  (for dashboards shared in app/global)
                 -You would also need to remove local.meta entry (not the whole file just the corresponding entry from C:\program files\splunk\etc\apps\search\metadata\local.meta file

C:\program files\splunk\etc\users\<usernameHere>\search\local\data\ui\views  (private dashboards)

For reports, you need to delete corresponding entries in the savedsearches.conf files (not the whole file just the corresponding entries) from following locations:

C:\program files\splunk\etc\apps\search\local\savedsearches.conf  (for reports shared in app/global)
                 -You would also need to remove local.meta entry (not the whole file just the corresponding entry from C:\program files\splunk\etc\apps\search\metadata\local.meta file

C:\program files\splunk\etc\users\<usernameHere>\search\local\savedsearches.conf  (private reports)
0 Karma

Jarohnimo
Builder

Thank you for your response! From the remedy it appears I shouldn't have only copied the pieces of search and users over to the new server that I absolutely needed to begin with. Weather I delete each Report/Dash via GUI or do it the way described above, it's seems tedious. But going through this way seems like I have to use extra brainpower making sure I don't nick the wrong thing out of the local.meta file.

Thanks again!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...