I recently had to pull a dashboard raw XML file off of an archive. What is the process for actually putting it back in? I copied the file to the original directory ... `$SPLUNK_HOME/etc/users/username/search/local/data/ui/views` ... Then I executed a debug/refresh which did make the dashboard visible to the UI on the cluster member, but it didn't result in that dashboard being replicated on the other cluster members. Then I used the UI to edit the dashboard, made a trivial change, and at that point, it was pushed.
I'm looking really for the best practice to actually restore something in an SHC ... be it a dashboard or a lookup table.
↧