topic Re: Dashboard not loading after Splunk Upgrade in Installation

Dashboard not loading after Splunk upgrade from 6.5.3 to 7.1.3.

nawazns5038 — Mon, 15 Jun 2020 19:01:38 GMT

After Upgrading Splunk from 6.5.3 to 7.1.3, some of my dashboards are not loading, they are stuck at Loading phase and not displaying any content.

What could be the reason? I haven't touched the XML of the dashboard. Is there anything related to a javascript of the new version or advanced XML not being loaded in the new version of Splunk ??

I am not sure if the XML is advanced or simple.

Re: Dashboard not loading after Splunk Upgrade

maciep — Sat, 20 Oct 2018 01:15:59 GMT

have you tried clearing your browser cache?

Re: Dashboard not loading after Splunk Upgrade

nawazns5038 — Mon, 22 Oct 2018 23:05:24 GMT

Yes, I have tried in incognito mode and other browser as well. Anyhow the documentation says the app is not compatible with Splunk 7.1, I want to know the reason behind it or is there a way to make the dashboard working.

Re: Dashboard not loading after Splunk Upgrade

adonio — Tue, 23 Oct 2018 02:17:16 GMT

which app is that?
are all dashboards from same app?

Re: Dashboard not loading after Splunk Upgrade

nawazns5038 — Tue, 23 Oct 2018 19:45:45 GMT

Splunk App for Salesforce.
Some are loading and some are stuck at the loading phase . Same XML works in 6.5.3
https://splunkbase.splunk.com/app/1931/

Re: Dashboard not loading after Splunk Upgrade

cmerriman — Tue, 23 Oct 2018 22:19:44 GMT

what dashboards in the app? can you provide a sample of the xml? with the app not being compatible with 7.1, there could be some outdated xml or searches in there.

Re: Dashboard not loading after Splunk Upgrade

nawazns5038 — Tue, 23 Oct 2018 23:44:31 GMT

<form>
  <label>Dashboard Performance</label>
  <description/>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="USER_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</populatingSearch>
      <default/>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="DASHBOARD_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</populatingSearch>
     <default/>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

That is the one of the dashboards that is not working. Any reason for not being compatible.

Re: Dashboard not loading after Splunk Upgrade

cmerriman — Wed, 24 Oct 2018 23:33:49 GMT

that is a lot of deprecated xml. try something like this:

<form>
  <label>Dashboard Performance</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>USER_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>DASHBOARD_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

you can see that populatingSearch is no longer supported. either is earliest/latestTime the way the inputs are configured has also changed, as far as formatting. if you can apply the differences between this xml and the original to the rest of the broken dashboards in the app, they should all probably start working.

Re: Dashboard not loading after Splunk Upgrade

nawazns5038 — Mon, 29 Oct 2018 19:12:57 GMT

Works very well . Thanks !!

Is there any documentation regarding the deprecated XML in the new version ?

Re: Dashboard not loading after Splunk Upgrade

cmerriman — Mon, 29 Oct 2018 21:07:44 GMT

here is documentation on some older XML:
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML

here is documentation on new XML:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

i don't think there is actually any document that specifies "Here are the deprecated nodes" or "replace these with these". if there are, @cgales9 could probably chime in, or @lstewart_splunk