topic Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated. in Dashboards & Visualizations

After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

yutaka1005 — Wed, 06 Nov 2019 05:34:58 GMT

My Splunk ver : v8.0
Server : Windows
Browser : chrome

When I re-change column color setting(* like Scale, Range) in table view after configured it once, <format> tags are duplicated.
Because of this, following message displayed, then I can't edit that setting on User Interface until delete <format> tag in Source.

Custom configuration. Edit from source

This isn't a big problem, but I think it's a bug in 8.0.
If anyone knows the workaround of this issue, please let me know.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

yutaka1005 — Thu, 07 Nov 2019 01:57:39 GMT

Please somebody help me!

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

niketn — Thu, 21 Nov 2019 07:12:14 GMT

@yutaka1005 I have seen the same issue. Each time Table column in Splunk UI in 8.x is clicked for formatting, it adds a duplicate Simple XML code in the backend. Which stops subsequent editing from front-end and keeps adding Simple XML code in the back-end.

Only workaround would be to cleanup Simple XML code and format table column only once.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

yutaka1005 — Fri, 22 Nov 2019 02:34:41 GMT

@niketnilay

Thank you for comment.
Also thank you for comment on slack.

I was relieved that other people have experienced the same bug.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

BasiliusCarver — Fri, 13 Dec 2019 00:04:07 GMT

I have the same thing on SplunkCloud 7.2.9 this is how I can trigger it in chrome and safari (both without extensions enabled)
Starting with this dashboard xml:

<dashboard>
    <label>testing_bloated_xml</label>
    <row>
    <panel>
        <table>
        <search>
            <query>| makeresults 1
| eval thing1 = 1
| eval thing2 = 1</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        </table>
    </panel>
    </row>
</dashboard>

I just have to format the two columns quickly and then I end up with duplicated format tags for field "thing1".

This gets a lot worse with more columns as it exponentially blows out the dashboard xml until the dashboard starts lagging heavily.
Then I have to edit the xml to remove the duplicates which is pretty painful.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

BasiliusCarver — Fri, 13 Dec 2019 00:09:51 GMT

I've also seen it happen when setting formatting in the "stats" tab of a normal search.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

efavreau — Mon, 16 Dec 2019 18:07:23 GMT

So have I in v7.2.8.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

BasiliusCarver — Mon, 16 Dec 2019 21:39:21 GMT

I wrote a script to cleanup the xml I've been using. It's not tested very well but has saved me a bit of time https://github.com/BasiliusCarver/splunkformatdedup

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

scottpestyk — Tue, 17 Dec 2019 20:35:19 GMT

Just as a heads up, this issue is probably the same as this issue that has been fixed and added to the 8.0.1 patch on Dec. 12th 2019:

Charting, reporting, and visualization issues
Date resolved: 2019-11-08

Issue number: SPL-179171, SPL-178113

Description: Editing color scale using colorpalette in dashboard creates custom configuration

I can't 100% confirm this fixes the issue, til I get a chance to try it out in a couple weeks.

But since it took me a while to find, I figured I'd add it to this page to hopefully help others.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

scottpestyk — Mon, 23 Dec 2019 14:29:50 GMT

I had a chance to try it out a couple of days ago, and it worked.

Problem solved in my case, so hopefully everyone else's too.

Re: After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

keith_d — Fri, 07 Feb 2020 17:47:02 GMT

Same in version 7.3.3 for setting up color formatting on columns in a normal Splunk search. I'm hopeful that once we get the latest 8.x version this will be fixed for us as well.