Splunk cannot find the "report_builder_display" view

[rachelneal]

We upgraded to 4.3 and now we are getting "Splunk cannot find the "report_builder_display" view.". Sounds similar to some of the issues others are having with the flashtimeline view. Any advice for this one?

[araitz · Accepted solution]

D'oh! It seems that this view was removed in 4.3, and we didn't do the best job of telling anyone about it. I'll file an issue about getting this change documented.

In 4.3, the report_builder view has been replaced by a report building workflow documented here:

http://docs.splunk.com/Documentation/Splunk/4.3/User/DefineReports

Thus, report_builder begat report_builder_display.

If you have saved searches that reference the report_builder view, you can edit savedsearches.conf to replace:

displayview = report_builder

with:

displayview = report_builder_display

Restart Splunk after you make the edits.

[ChrisG]

We have updated the 4.3 upgrade topic with this information, thanks for catching it! http://docs.splunk.com/Documentation/Splunk/latest/Installation/Aboutupgradingto4.3READTHISFIRST