Hey everyone. I have a dashboard which was set up with around 8 searches, each using its own search. The dashboard works correctly. I have created a clone to do testing with, and have tested that the clone works. I am now trying to trim this back into using a single search and several post processes. According to the documentation I am doing everything right.
So far I switched all of the "searchTemplate" tags to "searchPostProcess" and removed the overlapping search (basically the search index=x sourcetype=y) portion. I saved and the form still loads fine. But then as soon as I add the
Here is the beginning of my dash:
<form>
<label>BCV IMS Customer Experience Dashboard (Simple)</label>
<searchTemplate>
index=xs XS_Calling_Number="*$TN$" OR XS_Called_Number="*$TN$" OR XS_Group_Number="*$TN$"|rex field=XS_Local_Call_ID "(?P<XS_Local_Call_ID_Trimmed>\d+)(?=:)"
</searchTemplate>
<fieldset>
<input type="text" token="TN">
<label>Enter Customer 10-Digit TN</label>
<default></default>
<seed></seed>
</input>
<input type="time" />
</fieldset>
<row>
...
Any thoughts? I am going to be opening a service ticket as well but was hoping I may get a faster answer here.
I don't know of any explanation for this better than what's in the UI Examples app. But if you read through the "simple xml" examples for form searches in there, you'll get a better understanding.
Basically the <form>
flavor of simple xml has some unintuitive boundaries past which it will stop working like this. You can have either a "normal" form or what I think it calls an "inverted flow" form. What you've tried to do here is have somewhat of a hybrid. And when the python sees some simple xml form syntax that it doesn't like, it just yanks the view from the system. There might be a stack trace in splunk_web_service.log but I'm not sure how informative it would be.
So to get to points beyond those two simple <form>
flavors, that's one of the reasons people switch to the advanced xml.
And as a piece of extra advice, if you're going to make the leap over to advanced XML you should get to know Sideview Utils at the same time. simple XML is easy but limited, advanced xml with sideview utils is weird but powerful. And in the middle the advanced XML without sideview utils is more complicated than either.
So I started pulling apart the search and I noticed that the issue only occurred when i had more than 1