All Apps and Add-ons

Spunk 8 Show Source Advanced XML OOPS

Explorer

We just upgraded to Splunk 8, and now when clicking "Show Source" in an Event Action, it goes to an error page. "Oops.
Looks like this view is using Advanced XML, which has been removed from Splunk Enterprise." It works in the "Search & Reporting" app, but not in our custom app we use (although I don't see any differences between the two). Any way to fix the link in the app?

Labels (1)
Tags (1)
0 Karma
1 Solution

Path Finder

The "show source" links calls up a dashboard view that lives in /app/search/default/data/ui/views/show_source.xml
If you created your app as a copy of the native "search" app, and didn't remove the "default" directory-- then Splunk can't find the original show_source.xml

Removing the "default" directory (specifically /data/ui/views-- but you should also not have the other stuff from Search app in there), let's splunk find the correct file, which has system-wide visibility (so every app can use it).

Edit: that bit about the "advanced XML error"
Thanks to @nick for pointing out--the show_source.xml view has been updated in more recent versions of Splunk, but copying it explicitly from an older version as I had is why specifically that error shows up.

View solution in original post

0 Karma

Path Finder

The "show source" links calls up a dashboard view that lives in /app/search/default/data/ui/views/show_source.xml
If you created your app as a copy of the native "search" app, and didn't remove the "default" directory-- then Splunk can't find the original show_source.xml

Removing the "default" directory (specifically /data/ui/views-- but you should also not have the other stuff from Search app in there), let's splunk find the correct file, which has system-wide visibility (so every app can use it).

Edit: that bit about the "advanced XML error"
Thanks to @nick for pointing out--the show_source.xml view has been updated in more recent versions of Splunk, but copying it explicitly from an older version as I had is why specifically that error shows up.

View solution in original post

0 Karma

Explorer

Thanks so much! There were some customizations in the default folder that i wasn't sure if were safe to delete. Deleting the data folder didn't work, so i copied the views from the search app to our custom app. Now "Show Source" works. Still have a few dashboards throwing the error, but at least making progress.

Path Finder

If you have customizations, they should be in /local...if not, perhaps you can move them there?
You could try just cp-ing off the default folder to a tmp folder, and see how that goes?

0 Karma

Explorer

Tried that, and show source stopped working. Removed the default and local folders from the app, and show source still wouldn't work.

0 Karma

Path Finder

Permission for [views] set to "export=system" in /search app?
-->Can you see the "show source" page from any other app, or is it missing from just one?

0 Karma

Explorer

Show source works in some of the other apps and is broken in some.

The search app does have it set:
[views/show_source]
export = system

0 Karma

Explorer

All of a sudden everything is working. Maybe i didn't wait long enough after restarting services. The "default" folder has been removed from our custom app. "Show Source" and "Advanced Edit" work now, some dashboards are still broken, but they probably do use advanced xml.

0 Karma

Path Finder

were you able to sort this out?

0 Karma

Communicator

Was this view written in Advanced XML by any chance? If it is the case, it was first deprecated in 6.3 years ago and it is now completely removed in Splunk 8.0. As a result, it has be rewritten in Simple XML in order to continue to function in Splunk 8.0.

https://docs.splunk.com/Documentation/Splunk/8.0.3/ReleaseNotes/Deprecatedfeatures

Explorer

I know, i've seen the doc. But how do i determine if it was written in advanced xml? It's not listed in the views, it's on the main search page.

0 Karma

Communicator

Are you able to see the source of your dashboard?
https://host:port/en-US/app/my_app/my_dashboard?showsource

SimpleXML is a subset of Advanced XML, so if you see any tags outside what is listed here,
https://docs.splunk.com/Documentation/Splunk/8.0.3/Viz/PanelreferenceforSimplifiedXML

chances are that it is in Advanced XML and has to be rewritten.

0 Karma

Explorer

It looks like the "search" page is the one with the issue. I tried adding ?showsource to the end of my search page url, and at the end after doing a search, but it just refreshes the page.

When I click on Show Source in an event, a url similiar to this shows up briefly before going to the OOPS page:

https://mysplunk/en-US/app/myapp/show_source?sid=1586985134.55214_B1086B2C-C090-4409-B71D-B9F32EA5CD...

Adding ?showsource to that link just directs to the OOPS page. Some of our "search" dashboards are broken too, but adding ?showsource just redirects to the OOPS page as well.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!