Splunk 5.0.1 - Cannot "Create Dashboard Panel"

[kmsnyde]

I cannot create a dashboard panel. I am using Splunk 5.0.1. After running a saved search and getting the results, I click "Create" > "Dashboard Panel". When the "Name" window is open, I type in "Test1". When I click "Next", I get an error in a red panel above the "Name" section that reads:

"Splunkd internal error - Data could not be written :/admin/search/savedsearches/Test1/vsid: hshunczm'

I have restarted Splunk with no noted errors and the problem remains. Can anyone help me solve this problem? Or has anyone else seen this problem.

Appreciate any help. Thanks.

[kmsnyde]

OK, solved. Perhaps I should have mentioned this previously, but I did not realize it was germane to the problem - The problem I initially noted was using the Admin account. However, I created a new account with admin privileges and creating a dashboard worked just fine. I'm not sure if there still exists a a problem as I initially thought that the Admin login wouild be able to accomplish any task. That doesn't seem to be the case with my instantiation. My Splunk is not yet operational, just testing use cases for searches and is why I did not bother to create other accounts.

[lguinn2]

This sounds like a file permissions problem. It can happen if Splunk runs sometimes as one user id (let's say "splunkIt") but another time someone uses a different id to start Splunk (like "root"). If this happens, then there will be a mix of file ownership and permissions in the $SPLUNK_HOME directory tree, which can lead to files suddenly being inaccessible or unable to be written.

You could have the problem that @somesoni2 points out - either as a consequence of this permissions problem or for some other reason. Open $SPLUNK_HOME/etc/users/admin/search/savedsearches.conf and find the Test1 stanza. Remove the line containing the vsid. Restart Splunk.

Finally, when you click on "Create > Dashboard Panel", the Name refers to the name that you want to use to save the search. You cannot enter the name of an existing saved search! So if Test1 already exists, you can't use that name again. You could give it a different name and go from there. OR, you could go to the dashboard, put the dashboard into "edit mode" and then click the button to add a dashboard panel - this menu will give you the option of choosing an existing saved search.

[kmsnyde]

I went to the "savedsearches.conf" and removed any vsid lines. I also removed vsid lines from any other "savedsearches.conf" elsewhere in splunk. I then restarted splunk. No change in the error message. I also tried to create a new dashboard from "Dashboard & Views". In unique ID I enterd "001". In Name, I entered "new_dashbaord". When I click create, I get the following error message:

Unable to create dashboard:[HTTP 500] Splunkd internal error; [{'tpe: "ERROR', 'code': None; "In handler 'views': Couild not find writer for: /admin/search/views/001[0] [C:\Program Files\Splunk\etc]"}]

[somesoni2]

Open the savedsearches.conf and search for the vsid mentioned in the error message. Delete and restart/refresh splunk.