Dashboards & Visualizations

Can't Share Views

David
Splunk Employee
Splunk Employee

I have one app named "CCM" (Cisco Call Manager) that has a number of views I would like to add to the menu of another app specific to my company, but I can't get them to show up in the menu of the main app. I looked at the answer here, but it didn't solve my issue.

Start of CCM's default.xml:

<nav>
<view name="flashtimeline" />
<view name="PhoneDashboard" default='true' />
<view name="PhoneFraudDashboard" />
<view name="PhoneOperationalDashboard" />
<view name="PhoneCallQualityDashboard" />
[...]

Selection of MainApp's default.xml:

<collection label="Phones">
  <view name="PhoneDashboard" />
  <view name="PhoneFraudDashboard" />
  <view name="PhoneOperationalDashboard" />
  <view name="PhoneCallQualityDashboard" />
 [...]

Selection of CCM's default.meta:

[views/PhoneDashboard]
export = system

[views/PhoneFraudDashboard]
export = system
[...]

I've also tried a variety of settings for the permissions (such as Genti suggested below), to no avail.

What am I missing here?

Tags (1)
0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

I found the problem. Turns out that in the Main App's local.meta, it had [views/Phone...] stanzas that overrode the ones in the CCM's default.meta. Not sure how they got there, but once I removed them the views showed up.

View solution in original post

0 Karma

David
Splunk Employee
Splunk Employee

I found the problem. Turns out that in the Main App's local.meta, it had [views/Phone...] stanzas that overrode the ones in the CCM's default.meta. Not sure how they got there, but once I removed them the views showed up.

0 Karma

David
Splunk Employee
Splunk Employee

They're definitely not anywhere private. They're all stored in /opt/splunk/etc/apps/CCM/default/data/ui/views:

splunktest:/opt/splunk/etc # egrep -R Forecasting .
./users/dveuve/CCM/local/viewstates.conf:[PhoneForecastingDashboardAdvanced:_current]
./users/dveuve/CCM/local/viewstates.conf:[PhoneForecastingDashboard:_current]
./apps/CCM/metadata/default.meta:[views/PhoneForecastingDashboard]
./apps/CCM/default/data/ui/nav/default.xml:    <view name="PhoneForecastingDashboard" />
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml:  <label>Forecasting Dashboard</label>
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml:      <h1>Forecasting Dashboard</h1>
./apps/AdBrite/default/data/ui/nav/default.xml:      <view name="PhoneForecastingDashboard" />
splunktest:/opt/splunk/etc # find . -type f -name "PhoneForecasting*"
./apps/CCM/default/data/ui/views/PhoneForecastingDashboard.xml

(Above showing all the files that reference the view label, and then more specifically, the location of the file for that view.)

Additionally, when I browse to the manage views page (/en-US/manager/CCM/data/ui/views), all the views are listed, and all show Global. Under permissions, they all say "Everyone: Read" and "Views Should Appear In: All Apps."

I'm assuming it's just something that I've got wrong, but I'm not sure what it is.

0 Karma

araitz
Splunk Employee
Splunk Employee

My guess is that you have saved your views and/or nav as 'private', meaning that they live in $SPLUNK_HOME/etc/users///local/... or somewhere similar.

By design, those views/nav will not be accessible by anyone else but you.

Ensure that you have shared out the nav and views at at least the app level (if not the global level).

0 Karma

David
Splunk Employee
Splunk Employee

Responded via an answer, so that I could provide a more full response.

0 Karma

Genti
Splunk Employee
Splunk Employee

perhaps try adding:

access = read : [ * ], write : [ admin ]

to your [] stanzas

0 Karma

David
Splunk Employee
Splunk Employee

No luck. So here is one other oddity. There is one view, which does show up, called "PhoneForecastingDashboard." But I have no explanation for why that one does show up. I did an egrep -R PhoneForecastingDashboard /opt/splunk/etc and the only hits came up were in default.xml (where it has the exact same syntax as the above) and in default.meta (where it has the exact same syntax as the above). So something does work.. but I don't know why.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...