Dashboards & Visualizations

How to upgrade Advanced XML file to simple XML file ?

tarunmalhotra79
Engager

Hi Team,

I am in a process of updating Splunk to version 8.0 and to Python 3.X.Also, for that I have remove all the usage of Advanced XML and convert it into the simple XML views.
But there are few dashboards/XML which seems to be impossible to convert them back to simple XML.

Could you please guide me the way how can i actually remove advance XML ? Or any kind of leads would be highly appreciated because manually changing them back to simple XML seems like a very tedious task.

For ex:-

APP Name:- Splunk Add for *Nix
Location:- tc_matrix_nix/default/data/ui/views/Setup.xml

Setup.XML

<view autoCancelInterval="100" template="search.html">
  <label>Splunk for Unix Add-on: Setup</label>

  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  </module>
  <module name="TA_Unix_FTR" layoutPanel="viewHeader">
  </module>

  <module name="TA_Unix_IFrame" layoutPanel="viewHeader">
    <param name="height">auto</param>
  </module>
</view>

Thanks in advance

0 Karma

rbardonetorian
Path Finder

convert from XML to html i believe is a current capability from the create dashboard UI.

0 Karma

snallam123
Path Finder

stuck with same issue, I think we cannot. Its easy to create new dashboards from your spl query than completely fixing xml

0 Karma

13tsavage
Communicator

Currently from my investigating into this matter, there are no guides on converting advanced xml back to simple xml. Only reference I read can be found from the Changes to Splunk Enterprise

  • *Advanced XML (deprecated in Splunk version 6.3): removed. If possible, replace Advanced XML with Simple XML. For more information about alternatives to Advanced XML available in Splunk Enterprise, see Building customizations for the Splunk platform *
0 Karma

nickhills
Ultra Champion

setup.xml is a special case. I'm pretty sure you don't want to modify that, as its not a dashboard per-se

From this looks of this, you have a customised version of the Splunk provided *nix app.
Have you looked at the latest version from Splunkbase to identify what has changed.

Seems a lot of work to rebuild everything, and loose the convinence of a Splunk curated app.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...