Installation

Dashboard not loading after Splunk upgrade from 6.5.3 to 7.1.3.

nawazns5038
Builder

After Upgrading Splunk from 6.5.3 to 7.1.3, some of my dashboards are not loading, they are stuck at Loading phase and not displaying any content.

What could be the reason? I haven't touched the XML of the dashboard. Is there anything related to a javascript of the new version or advanced XML not being loaded in the new version of Splunk ??

I am not sure if the XML is advanced or simple.

Labels (1)
0 Karma
1 Solution

cmerriman
Super Champion

that is a lot of deprecated xml. try something like this:

<form>
  <label>Dashboard Performance</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>USER_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>DASHBOARD_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

you can see that populatingSearch is no longer supported. either is earliest/latestTime the way the inputs are configured has also changed, as far as formatting. if you can apply the differences between this xml and the original to the rest of the broken dashboards in the app, they should all probably start working.

View solution in original post

0 Karma

cmerriman
Super Champion

that is a lot of deprecated xml. try something like this:

<form>
  <label>Dashboard Performance</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>USER_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>DASHBOARD_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

you can see that populatingSearch is no longer supported. either is earliest/latestTime the way the inputs are configured has also changed, as far as formatting. if you can apply the differences between this xml and the original to the rest of the broken dashboards in the app, they should all probably start working.

0 Karma

nawazns5038
Builder

Works very well . Thanks !!

Is there any documentation regarding the deprecated XML in the new version ?

0 Karma

cmerriman
Super Champion

here is documentation on some older XML:
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML

here is documentation on new XML:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

i don't think there is actually any document that specifies "Here are the deprecated nodes" or "replace these with these". if there are, @cgales9 could probably chime in, or @lstewart_splunk

0 Karma

maciep
Champion

have you tried clearing your browser cache?

0 Karma

nawazns5038
Builder

Yes, I have tried in incognito mode and other browser as well. Anyhow the documentation says the app is not compatible with Splunk 7.1, I want to know the reason behind it or is there a way to make the dashboard working.

0 Karma

adonio
Ultra Champion

which app is that?
are all dashboards from same app?

0 Karma

nawazns5038
Builder

Splunk App for Salesforce.
Some are loading and some are stuck at the loading phase . Same XML works in 6.5.3
https://splunkbase.splunk.com/app/1931/

0 Karma

cmerriman
Super Champion

what dashboards in the app? can you provide a sample of the xml? with the app not being compatible with 7.1, there could be some outdated xml or searches in there.

0 Karma

nawazns5038
Builder
<form>
  <label>Dashboard Performance</label>
  <description/>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="USER_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</populatingSearch>
      <default/>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="DASHBOARD_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</populatingSearch>
     <default/>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

That is the one of the dashboards that is not working. Any reason for not being compatible.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...