On Splunk 6.5.1, why am I unable to delete or change "Display for" permissions on migrated dashboards?

[rarneson]

Having a little problem with "old dashboards" we have in our current Search Head Cluster (SHC). All newly created dashboards work just fine.

Where the old dashboards came from is our old Splunk Enterprise Search Head Cluster. I took the existing dashboards off there and put them into our new cluster deployer ($SPLUNK_HOME/etc/shcluster/... clustermaster machine) and redeployed them to the new SHC members.

This all worked fantastic. Or so I thought. A month or two down the line, someone noticed we could no longer delete old dashboards or flip them from "private" to "app" or vice versa. We can edit the contents of the dashboard just fine. I'm trying to do this with the same LDAP user that create them as well as the local Splunk admin user.

Once again, all new dashboards create post "migration" are working great.

So my question is, is there any way to fix these old dashboards? I'm currently on Splunk 6.5.1.

[frobinson_splun · Accepted solution]

Hi @rarneson,
I think this info in our docs might apply to your situation:
http://docs.splunk.com/Documentation/Splunk/6.5.1/DistSearch/PropagateSHCconfigurationchanges#Manage...

I'm not sure what the workaround might be, though. I'm going to ask around for advice, will post an update when I learn more.

Hope this helps!

[Steve_G_]

As the cited doc states, "The only way to delete an app-level baseline knowledge object is to redeploy an updated version of the app that does not include the knowledge object." So, that is the workaround.

[rarneson]

Ahh, I was thinking that might be the case since I couldn't seem to find another method. Luckily this is nothing major, just an mild annoyance a user had sent me. I appreciate pointing me to the docs. If there is another workaround other than redeploying I'd love to hear it though.

Have a good one & thanks!

[frobinson_splun]

Stay tuned! Hoping to have some additional info in the next couple of days.

[rarneson]

Hi, just checking to see if anyone might have an idea on this one. Thanks!