Dashboards & Visualizations

Unable to delete dashboards in an app

ww9rivers
Communicator

This seems to be a bit strange: We are running Enterprise version 8.1.5 in a search head cluster. A custom app is created for our security team to manage their dashboards, etc.

The strange thing is, some of the dashboards cannot be deleted -- there is just no delete (or move) option:

dashboards.png

I've checked on all the individual nodes in the cluster, they are all in the local/ folder in the app.

This is on-prem Splunk Enterprise, so I can manually delete them from all the nodes as an admin. But I would like to understand what I am missing here.

I did search for answers here and found this one post. But that is in the Splunk Cloud. So I am not sure if my issue is a bug like that in the posting or not.

Thanks for any thoughts / discussions. Happy holidays!

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Have you checked that you haven’t those on deployer?

0 Karma

ww9rivers
Communicator

I did not check that.

I just checked now. All the six dashboards are found on the deployer, also in the local/ folder (I guess it is desired for this app to always be editable by the security team.) -- Furthermore, there are more dashboards on the deployer. The team is cleaning up the app. It seems that they have been able to delete most of what they want to delete.

By the way, I have also checked and double checked the permissions on all the dashboards. They all have "write" permission granted to the admin role.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

If those dashboards are deployed by deployer you cannot delete those from SHC node. Only those dashboards which you have directly created on SHC node you can delete unless you later add those to deploy via deployer.

Currently there are several ways how deployer push those KOs from Deployer to SHC nodes. See that from Choose a deployer push mode

r. Ismo

0 Karma

ww9rivers
Communicator

In my case, all the 6 dashboards currently in the local/ folder all exist in the deployer, so they have been deployed at some point. Why only two of them have the "Move" and "Delete" options?

I guess my ultimate question is: What makes the search head cluster nodes decide which dashboards can be deleted and not the others?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...