Dashboards & Visualizations

Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

simpkins1958
Contributor

Lots of my dashboard panels in simple XML are no longer working since upgrading to 6.5. Getting "No results found." But when I open up in search the SPL work fine with lots of results.

Issue appears to be tab characters in my SPL.

    <search base="baseSearch_wwan_connectfailure">
      <query>stats count as Failures by car 
           | sort-Failures 
           | rename car as "Carrier"
      </query>

If I replace the tab characters with spaces all is working again.

Anyone else seeing this issue?

0 Karma

simpkins1958
Contributor

Replacing all tab characters with spaces in my XML files fixed the issue.

frobinson_splun
Splunk Employee
Splunk Employee

Hi @simpkins1958,
Our engineering team has been looking into this and we were able to reproduce the behavior today. From what I can tell, this issue does not occur if you are creating or editing a dashboard within the Dashboard Editor interface in Splunk Web, but it might occur if another editor, such as VIM, is used. We're going to investigate this further.

We've filed a ticket to track this as a bug/known issue and look into a fix in an upcoming version. Thanks for posting your notes and the workaround!

0 Karma

ChrisBell04
Communicator

Per support, this bug is SPL-131250, and was resolved as of 6.5.2. It specifically only broke simple xml dashboards which had TAB characters.

0 Karma

simpkins1958
Contributor

alt text

0 Karma

rjthibod
Champion

Weird. I too have had some issues with 6.5 SimpleXML, but unrelated to this. I will be on the lookout for anything similar and will report to the Splunk team.

0 Karma

rjthibod
Champion

I have not seen this issue and I use tabs a lot. What browser are you using to access the dashboards? Are your SimpleXML files in UTF-8 / ASCII format?

0 Karma

simpkins1958
Contributor

Seeing the issue in latest versions of Chrome and IE. XML files are ASCII format.

0 Karma

rjthibod
Champion

Also, when you click Edit -> Source, does Splunk show any Validation errors or warnings XML? This is a new feature in 6.5 that has become very handy.

0 Karma

simpkins1958
Contributor

Nope no validation errors.

All works when I change tabs to spaces.

0 Karma

rjthibod
Champion

what do you see when you look at the job inspector? does it look like the job inspector show the searches in what looks like a reasonably accurate translation for the litsearch field?

0 Karma

simpkins1958
Contributor

See the screen shot I just attached. Job inspector is reporting 40K+ events.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...