Dashboards & Visualizations

Why is my dashboard reporting error "Node search is not allowed here"?

diavolo
Path Finder

When I tried Global Search, the dashboard shows warning "Node is not allowed here".
What's wrong with it?

alt text

xml of the dashboard is the following.

<dashboard>
  <label>LABEL TITLE</label>
  <search id="baseSearch">
    <qurey>SEARCH PROCESS LANGUAGE</qurey>
    <earliest>0</earliest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <title>PANEL TITLE</title>
      <chart>
        <search base="baseSearch">
          <query>POST PROCESS SPL</query>
        </search>
1 Solution

ppablo
Retired

Hi @diavolo

I'm not sure if this is the cause of your issue since I haven't worked with XML before, but you have typos in the tags on line 4. You spelled "query" as "qurey"

View solution in original post

jkoby_splunk
Splunk Employee
Splunk Employee

This error can also occur if there's a tag without a inside of it.

0 Karma

cjohnk
Explorer

Can you please expand on that? I am also having this issue, but it's not due to a misspelling, that I can see.

The error is on the following line:

<search index="windows" Account_Name="$Locked_Out_Account_Name$" EventCode="4624">

If I change the <search index= to <search ref= than it works fine. However, I want to perform a direct search here because I want to reference the previously created variable $Locked_Out_Account_Name$. Perhaps there's a way to push the variable in a referenced report and search with it there?

Here's the full code:

<form refresh="60">
  <label>Account PC (Test 11.21) Dashboard</label>
  <description>Blah.</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="Locked_Out_Account_Name" searchWhenChanged="true" depends="$justHideMe$">
      <label>Locked_Out_Account_Name</label>
      <search ref="Account PC (Test 11.21) Report">
        <earliest>-1h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>Locked_Out_Account_Name</fieldForLabel>
      <fieldForValue>Locked_Out_Account_Name</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <font size="5">
         <body1>Last Refresh Time</body1>
         <body2>$time$</body2>
         <body3>$Locked_Out_Account_Name$</body3>
        </font>
        <style>
            table thead tr th, td{
           font-size:175% !important;
          }
        </style>
      </html>
      <table>
        <title>Account PC (Test 11.21) Report</title>
        <search ref="Account PC (Test 11.21) Report">
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

ppablo
Retired

Hi @diavolo

I'm not sure if this is the cause of your issue since I haven't worked with XML before, but you have typos in the tags on line 4. You spelled "query" as "qurey"

diavolo
Path Finder

After I fixed the typo, the warning has cleared. I wonder the warning message makes no sense against such error...
Thank you!

ppablo
Retired

No problem! Yeah, that error is not very clear ;0

Oh by the way, thanks for awarding me points 🙂 Just so you know for the future, if you want to give users karma points on Splunk Answers without losing any of your own points, you can just upvote their answers by clicking the up arrow on the left side.

Have a good weekend!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...