I'm sure you've already solved this one, but maybe it'll help someone else down the line We've ran into a similar issue lately - in our case it was caused by a pre-9.x copy of search.xml in $SPLUNK_HOME/etc/apps/search/local/ui/dashboards     ... View more