All Apps and Add-ons

Spunk 8 Show Source Advanced XML OOPS

kornkid42
Explorer

We just upgraded to Splunk 8, and now when clicking "Show Source" in an Event Action, it goes to an error page. "Oops.
Looks like this view is using Advanced XML, which has been removed from Splunk Enterprise." It works in the "Search & Reporting" app, but not in our custom app we use (although I don't see any differences between the two). Any way to fix the link in the app?

Labels (1)
Tags (1)
0 Karma
1 Solution

ridwanahmed
Path Finder

The "show source" links calls up a dashboard view that lives in /app/search/default/data/ui/views/show_source.xml
If you created your app as a copy of the native "search" app, and didn't remove the "default" directory-- then Splunk can't find the original show_source.xml

Removing the "default" directory (specifically /data/ui/views-- but you should also not have the other stuff from Search app in there), let's splunk find the correct file, which has system-wide visibility (so every app can use it).

Edit: that bit about the "advanced XML error"
Thanks to @nick for pointing out--the show_source.xml view has been updated in more recent versions of Splunk, but copying it explicitly from an older version as I had is why specifically that error shows up.

View solution in original post

ridwanahmed
Path Finder

The "show source" links calls up a dashboard view that lives in /app/search/default/data/ui/views/show_source.xml
If you created your app as a copy of the native "search" app, and didn't remove the "default" directory-- then Splunk can't find the original show_source.xml

Removing the "default" directory (specifically /data/ui/views-- but you should also not have the other stuff from Search app in there), let's splunk find the correct file, which has system-wide visibility (so every app can use it).

Edit: that bit about the "advanced XML error"
Thanks to @nick for pointing out--the show_source.xml view has been updated in more recent versions of Splunk, but copying it explicitly from an older version as I had is why specifically that error shows up.

kornkid42
Explorer

Thanks so much! There were some customizations in the default folder that i wasn't sure if were safe to delete. Deleting the data folder didn't work, so i copied the views from the search app to our custom app. Now "Show Source" works. Still have a few dashboards throwing the error, but at least making progress.

ridwanahmed
Path Finder

If you have customizations, they should be in /local...if not, perhaps you can move them there?
You could try just cp-ing off the default folder to a tmp folder, and see how that goes?

0 Karma

kornkid42
Explorer

Tried that, and show source stopped working. Removed the default and local folders from the app, and show source still wouldn't work.

0 Karma

ridwanahmed
Path Finder

Permission for [views] set to "export=system" in /search app?
-->Can you see the "show source" page from any other app, or is it missing from just one?

0 Karma

kornkid42
Explorer

Show source works in some of the other apps and is broken in some.

The search app does have it set:
[views/show_source]
export = system

0 Karma

kornkid42
Explorer

All of a sudden everything is working. Maybe i didn't wait long enough after restarting services. The "default" folder has been removed from our custom app. "Show Source" and "Advanced Edit" work now, some dashboards are still broken, but they probably do use advanced xml.

0 Karma

ridwanahmed
Path Finder

were you able to sort this out?

0 Karma

tauliang
Communicator

Was this view written in Advanced XML by any chance? If it is the case, it was first deprecated in 6.3 years ago and it is now completely removed in Splunk 8.0. As a result, it has be rewritten in Simple XML in order to continue to function in Splunk 8.0.

https://docs.splunk.com/Documentation/Splunk/8.0.3/ReleaseNotes/Deprecatedfeatures

kornkid42
Explorer

I know, i've seen the doc. But how do i determine if it was written in advanced xml? It's not listed in the views, it's on the main search page.

0 Karma

tauliang
Communicator

Are you able to see the source of your dashboard?
https://host:port/en-US/app/my_app/my_dashboard?showsource

SimpleXML is a subset of Advanced XML, so if you see any tags outside what is listed here,
https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/PanelreferenceforSimplifiedXML

chances are that it is in Advanced XML and has to be rewritten.

0 Karma

kornkid42
Explorer

It looks like the "search" page is the one with the issue. I tried adding ?showsource to the end of my search page url, and at the end after doing a search, but it just refreshes the page.

When I click on Show Source in an event, a url similiar to this shows up briefly before going to the OOPS page:

https://mysplunk/en-US/app/myapp/show_source?sid=1586985134.55214_B1086B2C-C090-4409-B71D-B9F32EA5CD...

Adding ?showsource to that link just directs to the OOPS page. Some of our "search" dashboards are broken too, but adding ?showsource just redirects to the OOPS page as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...