Dashboards & Visualizations

Dashboard Panel Options Are Ignored by Splunk

Kyle_Brandt
Path Finder

I have tried adding the options to a dashboard, but after saving none of the options seems to have any effect:

The XML that is saved is:

<?xml version='1.0' encoding='utf-8'?>
<dashboard>
  <!--
NOTE: This file was automatically generated by Splunk.  Use caution when editing manually.
-->
  <label>Backup View</label>
  <row>
    <event>
      <searchName>Bacula Jobs in The Last 2 Days</searchName>
      <title>Bacula Jobs</title>
      <option name="count">5</option>
      <option name="showPager">true</option>
      <option name="displayRowNumbers">false</option>
    </event>
  </row>
</dashboard>

The Row numbers are still there, there are 10 items, and I don't see any pagination.

Reference:
http://www.splunk.com/base/Documentation/latest/Developer/PanelReference

Also, here is the output of the ?showsource=true:

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>Backup View</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="actionsMenuFilter">dashboard</param>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" group="Bacula Jobs" autoRun="True">
    <param name="savedSearch">Bacula Jobs in The Last 2 Days</param>
    <param name="groupLabel">Bacula Jobs</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">Bacula Jobs in The Last 2 Days</param>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator"/>
        <module name="Paginator">
          <param name="count">5</param>
          <param name="entityName">results</param>
          <module name="EventsViewer">
            <param name="count">5</param>
            <param name="displayRowNumbers">false</param>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

Also, the log looks like it tells the paginator to use 10:
"GET /en-US/module/system/Splunk.Module.Paginator/render?length=10&count=10&max_pages=10&offset=0&client_app=search HTTP/1.1" 200 - "http://ny-man01.ny.stackoverflow.com:8000/en-US/app/search/backupdash2"

Tags (2)

MartinHarper
Path Finder

I had the same issue. It occurs because the "viewstate" of the saved search overrides the dashboard XML. This is the opposite of the behavior for charts, and in my opinion is a bug.

Workarounds:

  1. Use a search string instead of a saved search. Of course, then you can't use cached results, but it might work for fast searches.
  2. Edit your viewstates.conf file to remove the viewstate associated with the saved search (corresponding to the one mentioned in the relevant stanza of savedsearches.conf) and restart the splunk server.

sideview
SplunkTrust
SplunkTrust

It looks like there's a bug in the python that runs the simplified XML. If you have an <event> node then it should be setting the entityName param on the paginator to "events". Since it's setting it to "results" that's why it's not applying.

The only solution that springs to mind is to just convert to the Advanced XML. (and change that 'results' to 'events' of course)

And as for the displayRowNumbers param -- one thing I can think of is to try setting displayRowNumbers to "False" not "false". The module conf file declares that 'False' and 'True' are the only valid options. Once upon a time this was the convention across all the module params, in that all the boolean module keys were title-case (False/True). However over time people started adding options that were all lowercase so it became a little muddled.

sideview
SplunkTrust
SplunkTrust
0 Karma

Kyle_Brandt
Path Finder

What is the process for converting it to advanced xml?

0 Karma

Branden
Builder

Did you make the change to the file directly (as opposed to doing it through the Manager)? If so, did you re-start Splunk after doing so?

0 Karma

Kyle_Brandt
Path Finder

I made the option through the manager and restarted splunk. I just found the file itself and it does line up with what the manager shows.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...