topic Re: Forms/Views behaviour after Splunk 6 Upgrade in Installation

Forms/Views behaviour after Splunk 6 Upgrade

mantockd — Mon, 14 Oct 2013 08:31:10 GMT

I have just upgraded to Splunk 6.0. When I do a form search it has completely different behaviour in comparison to Splunk 5.

In Splunk 5 blank fields were like behaving as if there was * in the search query and all results were returned. Now if I do the same thing in Splunk 6.0 I get this error:

Search query is not fully resolved.

Even when I just launch the view I get the same error.

Re: Forms/Views behaviour after Splunk 6 Upgrade

sideview — Mon, 14 Oct 2013 17:35:02 GMT

Is this view written in the <form> flavor of Simple XML?

Re: Forms/Views behaviour after Splunk 6 Upgrade

melting — Mon, 14 Oct 2013 17:45:09 GMT

Yeah this is a subtle change in the two versions

To work around use an empty default:

<input type="text" token="get3">
    <label>Get from drilldown: Count</label>
    <default></default>
</input>

Re: Forms/Views behaviour after Splunk 6 Upgrade

mantockd — Mon, 21 Oct 2013 11:22:22 GMT

This did not resolve the problem.

Re: Forms/Views behaviour after Splunk 6 Upgrade

melting — Mon, 21 Oct 2013 15:04:13 GMT

What is your xml?

Re: Forms/Views behaviour after Splunk 6 Upgrade

mantockd — Wed, 23 Oct 2013 12:29:40 GMT

Yes this is flavor of Simple XML

Re: Forms/Views behaviour after Splunk 6 Upgrade

mantockd — Wed, 23 Oct 2013 12:35:42 GMT

flavor of Simple XML

Re: Forms/Views behaviour after Splunk 6 Upgrade

mantockd — Wed, 23 Oct 2013 13:13:37 GMT

I should have more accurately stated, this does solve the problem when searching, if I take * as the default, but the problem still remains on launching the form.