Splunk Search

Why am I unable to make a dashboard from the "Search" App global with error "Could not find writer for : /nobody/search/views/ [0] [E:\Splunk\etc]"?

jcpsupport
New Member

New to Splunk. Created a custom dashboard using Search App, but it is private. When I am trying to make it Global, I am getting the following error:

In handler 'views': Could not find writer for: /nobody/search/views/ [0] [E:\Splunk\etc] 

My account has admin rights and I also checked splunkd.log. The only related message there is:

WARN  ConfPathMapperManager - Could not find writer for: /nobody/search/views/ [0] [E:\Splunk\etc]

Please help me figure this out.

P.S. If I create dashboards under any app other than the "Search" app, I can make them global without problems.

0 Karma

ryanoconnor
Builder

This sounds a lot like a permissions issue. In this case I'd try and let Splunk tell you more about Splunk.

To do that, have you tried searching the _internal index for local splunkd logs related to this? It might help to attempt to make the change, record the time, and then search at that time for

index=_internal ERROR

Then you should be able to start to drill down to see what might be going on and filter out irrelevant log sources like remote_searches or the scheduler.

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...