All Apps and Add-ons

Why am I unable to import panels from the Splunk App for Windows Infrastructure to a dashboard in the Search and Reporting app?

New Member


I am trying to create a new dashboard in my Search and Reporting app, but when I try to import some panels from the Splunk App for Windows Infrastructure, I keep getting this error:

This XML file does not appear to have any style information associated with it. The document tree is shown below.

So how can I use these dashboards, and is there a possibility to view and edit their associated XML file?

I would appreciate any help!

0 Karma

Path Finder

That app is written using the Django framework so it stores its dashboards using Django tags and html rather than xml. That is why you are getting that error because there is indeed no xml.

However, if you are familiar enough with html/js you can pick what you want out of the Django app and put it in your own dashboards. You will have to utilize html rather than simple or advanced xml to allow you to paste html in. If you designed your dashboard in xml you can still convert it to html right from the UI.

The aforementioned app's html can be found in the following directory:

(where on Linux $SPLUNK_HOME$ = /opt/splunk/)

if you look inside that dir, inside ad/ and windows/ are some html files containing the prebuilt dashboards.

New Member

Thank you for your kind response !
Could you give me some tips, how to import these Django dashboards into my HTML custom dashboards in the Search and Reporting App ?

0 Karma

Path Finder

Once you have created an HTML dashboard using the Search and Reporting app, while viewing that dashboard you should be able to click "edit" in the upper right hand corner and select "edit source". Here is where you will paste HTML and JS code for a dashboard. You can find the code for the splunk app for windows infrastructure dashboards in the directory mentioned in my first post: $SPLUNK_HOME$/etc/apps/splunk_app_windows_infrastructure/django/splunk_app_windows/infrastructure/templates/

For example if you want to copy from the Computer Audit dashboard in splunk_app_windows_infrastructure you would go into $SPLUNK_HOME$/etc/apps/splunk_app_windows_infrastructure/django/splunk_app_windows/infrastructure/templates/ad/audit_computer.html which looks like this

{% extends "splunkdj:base_with_app_bar.html" %}
{% load splunkmvc %}
{% block title %}Computer Audit | Splunk{% endblock title %}

{% block css %}
    <link rel="stylesheet" type="text/css" href="{{STATIC_URL}}{{app_name}}/custom.css" />
    <link rel="stylesheet" type="text/css" href="{{STATIC_URL}}splunkjs/css/dashboard.css" />
{% endblock css %}

{% block content %}
        <div class="dashboard-body container-fluid main-section-body" id="splunk-app-microsoft-panel-container">
            <div class="dashboard-row">
                <div class="dashboard-cell span-full" id="splunk-app-microsoft-inputs">
{% endblock content%}

{% block js %}
        requirejs.config({ urlArgs: "bust=255430" });
require(['jquery', 'splunk_app_windows_infrastructure/paletterenderer'], function($, renderer) {
            renderer.render($('#splunk-app-microsoft-panel-container'), "ActiveDirectory.ComputerAudit542");
{% endblock js %}

inside the content block is html for displaying the panel and inside the js block is the script that renders the panel. You will need to be able to place these snippets into the proper place in your dashboard which is why being familiar with HTML/JS is required for this.

Also be sure that in $SPLUNK_HOME$/etc/apps/splunk_app_windows_infrastructure/metadata, you have a stanza that looks like this:

# This example would make all of the objects in an app globally accessible to
# all apps

as it states that will allow the objects from the app to be available in other apps such as Search & Reporting as you desire.

Alternatively it may be easier to just make your own dashboard that has the same functionality as the dashboard you are trying to copy.

Hope this works for you.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!