000037791 - Delete custom dashboards in mongo in RSA NetWitness 11.x

Document created by RSA Customer Support Employee on Aug 6, 2019
Version 1Show Document
  • View in full screen mode

Article Content

Article Number000037791
Applies ToRSA Product Set: NetWitness Logs & Network
RSA Product/Service Type: NetWitness UI
RSA Version/Condition: 11.x
Platform: CentOS
O/S Version: 7
IssueThe following steps will allow you to go into mongo and delete any custom dashboards you have created, especially if you are unable to delete the dashboards directly from the RSA NetWitness UI.
TasksBefore proceeding with the deletion procedure below, you can run the NetWitness Disaster Recovery Tool from the Admin Server to back up the mongo database to prevent data loss.
  1. From the Admin Server, log into mongo.

    # mongo admin -u deploy_admin -p <mongo password>

  2. Display the list of databases and choose the sa database.

    > show dbs
    > use sa

  3. Display the list of collections and choose the dashboard collection. This will display information about each dashboard that is currently in your RSA NetWitness UI.

    > show collections
    > db.dashboard.find.pretty()

  4. Find your custom dashboard within the collection. The name of a dashboard is located under the "title" field for that dashboard. For example, if the name of a custom dashboard is "test," then you would see : "title" : "test" for that dashboard.
  5. Run the following command to remove the custom dashboard from the collection.

    > db.dashboard.remove({"title":"<title of custom dashboard>"})

    ex. db.dashboard.remove({"title":"test"})

  6. Run the following command to confirm that the custom dashboard was removed. This should not produce any output if the dashboard was successfully removed.

    > db.dashboard.find({"title":"<title of custom dashboard>"})

    ex. db.dashboard.find({"title":"test"})

  7. Go into the RSA NetWitness UI > Monitor > Dashboards and navigate through your list of dashboards to confirm that the custom dashboard has been removed from the UI, as well.