Dashboards & Visualizations

After upgrading to Splunk 6.5, why are dashboards not loading with error "could not create search"?

RAYUDU_NARA
Explorer

Hi Team,

We have upgraded Splunk from version 6.2.4 to 6.5 , after this change we are facing some issues with dashboard.
For all dashboards it is showing an error "could not create search" .
Kindly help me on this as priority, this issue is in Splunk production environment.

Thanks in advance.
Rayudu

Tags (2)
0 Karma

hardikJsheth
Motivator

There have been major upgrade in the UI framework with 6.5. In earlier version it was allowed to write elements as

 <input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default/>
    </input>

But with 6.5 , you must write it as follows:

<input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default></default>
    </input>

This can be one of the reason if your dashboard was working fine with Splunk <6.5

0 Karma

niketn
Legend

@RAYUDU_NARA can you please send dashboard's XML snippet for search being used in your dashboards? If you are on 6.2.4 and using populatingSearch for your queries, you can change search instead. Refer to following documentation for Simple XML deprecated commands.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/PanelreferenceforSimplifiedXML#Search_elements...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

RAYUDU_NARA
Explorer

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

0 Karma

niketn
Legend

@RAYUDU_NARA... so seems like some required capability is missing. Have you checked whether you can run the searches in the dashboard directly from Splunk Search or is it only dashboard which is not working?

Your Splunk admin should revisit concurrent search settings and jobs disc quota for Power User role. Also revisit the capabilities and searchable index. Not sure though as to how migration would have impacted this.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

you can run the searches that populate the dashboards in the search window?
can you give an example of a dashboard XML that isn't working?

0 Karma

RAYUDU_NARA
Explorer

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

0 Karma

adonio
Ultra Champion

try to clear all cookies and cache from browser

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...