Dashboards & Visualizations

On Splunk 6.5.1, why am I unable to delete or change "Display for" permissions on migrated dashboards?

rarneson
Explorer

Having a little problem with "old dashboards" we have in our current Search Head Cluster (SHC). All newly created dashboards work just fine.

Where the old dashboards came from is our old Splunk Enterprise Search Head Cluster. I took the existing dashboards off there and put them into our new cluster deployer ($SPLUNK_HOME/etc/shcluster/... clustermaster machine) and redeployed them to the new SHC members.

This all worked fantastic. Or so I thought. A month or two down the line, someone noticed we could no longer delete old dashboards or flip them from "private" to "app" or vice versa. We can edit the contents of the dashboard just fine. I'm trying to do this with the same LDAP user that create them as well as the local Splunk admin user.

Once again, all new dashboards create post "migration" are working great.

So my question is, is there any way to fix these old dashboards? I'm currently on Splunk 6.5.1.

0 Karma
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rarneson,
I think this info in our docs might apply to your situation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

I'm not sure what the workaround might be, though. I'm going to ask around for advice, will post an update when I learn more.

Hope this helps!

View solution in original post

frobinson_splun
Splunk Employee
Splunk Employee

Hi @rarneson,
I think this info in our docs might apply to your situation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

I'm not sure what the workaround might be, though. I'm going to ask around for advice, will post an update when I learn more.

Hope this helps!

Steve_G_
Splunk Employee
Splunk Employee

As the cited doc states, "The only way to delete an app-level baseline knowledge object is to redeploy an updated version of the app that does not include the knowledge object." So, that is the workaround.

rarneson
Explorer

Ahh, I was thinking that might be the case since I couldn't seem to find another method. Luckily this is nothing major, just an mild annoyance a user had sent me. I appreciate pointing me to the docs. If there is another workaround other than redeploying I'd love to hear it though.

Have a good one & thanks!

frobinson_splun
Splunk Employee
Splunk Employee

Stay tuned! Hoping to have some additional info in the next couple of days.

0 Karma

rarneson
Explorer

Hi, just checking to see if anyone might have an idea on this one. Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...