Dashboards & Visualizations

Why is my dashboard reporting error "Node search is not allowed here"?

diavolo
Path Finder

When I tried Global Search, the dashboard shows warning "Node is not allowed here".
What's wrong with it?

alt text

xml of the dashboard is the following.

<dashboard>
  <label>LABEL TITLE</label>
  <search id="baseSearch">
    <qurey>SEARCH PROCESS LANGUAGE</qurey>
    <earliest>0</earliest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <title>PANEL TITLE</title>
      <chart>
        <search base="baseSearch">
          <query>POST PROCESS SPL</query>
        </search>
1 Solution

ppablo
Retired

Hi @diavolo

I'm not sure if this is the cause of your issue since I haven't worked with XML before, but you have typos in the tags on line 4. You spelled "query" as "qurey"

View solution in original post

jkoby_splunk
Splunk Employee
Splunk Employee

This error can also occur if there's a tag without a inside of it.

0 Karma

cjohnk
Explorer

Can you please expand on that? I am also having this issue, but it's not due to a misspelling, that I can see.

The error is on the following line:

<search index="windows" Account_Name="$Locked_Out_Account_Name$" EventCode="4624">

If I change the <search index= to <search ref= than it works fine. However, I want to perform a direct search here because I want to reference the previously created variable $Locked_Out_Account_Name$. Perhaps there's a way to push the variable in a referenced report and search with it there?

Here's the full code:

<form refresh="60">
  <label>Account PC (Test 11.21) Dashboard</label>
  <description>Blah.</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="Locked_Out_Account_Name" searchWhenChanged="true" depends="$justHideMe$">
      <label>Locked_Out_Account_Name</label>
      <search ref="Account PC (Test 11.21) Report">
        <earliest>-1h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>Locked_Out_Account_Name</fieldForLabel>
      <fieldForValue>Locked_Out_Account_Name</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <font size="5">
         <body1>Last Refresh Time</body1>
         <body2>$time$</body2>
         <body3>$Locked_Out_Account_Name$</body3>
        </font>
        <style>
            table thead tr th, td{
           font-size:175% !important;
          }
        </style>
      </html>
      <table>
        <title>Account PC (Test 11.21) Report</title>
        <search ref="Account PC (Test 11.21) Report">
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

ppablo
Retired

Hi @diavolo

I'm not sure if this is the cause of your issue since I haven't worked with XML before, but you have typos in the tags on line 4. You spelled "query" as "qurey"

diavolo
Path Finder

After I fixed the typo, the warning has cleared. I wonder the warning message makes no sense against such error...
Thank you!

ppablo
Retired

No problem! Yeah, that error is not very clear ;0

Oh by the way, thanks for awarding me points 🙂 Just so you know for the future, if you want to give users karma points on Splunk Answers without losing any of your own points, you can just upvote their answers by clicking the up arrow on the left side.

Have a good weekend!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...