Hello ,
When creating a new dashboard , the xml file for it cant be found anywhere on my pc , its really weird because obviously splunk is saving something , somewhere.
Scanned all of my drivers with both names & content search for the xml , and nothing showed up.
Would appreciate any help to find the file.
If you've left the view private, it'll be stored here: $SPLUNK_HOME/etc/users/your_user/that_app/local/data/ui/views/view_name.xml
.
If you've shared the view in the app, it'll be stored here: $SPLUNK_HOME/etc/apps/that_app/local/data/ui/views/view_name.xml
.
If you're on windows you should note, your own user may not initially have access to read those directories - that might stump the search you've been running.