All Apps and Add-ons

estreamer dashboard XML validation errors

New Member

Morning All,

Popped onto the estreamer dashboard this morning in our Splunk Cloud environment ( and noticed none of the metrics/statistics were populating.

Checking into the dashboard code itself and can see validation warnings specifically in relation to 'legacy notation' or 'unknown option name' - I was under the impression that a Splunk app updated automatically within the Splunk environment? is there a way to update the notations/options so Splunk can then populate the dashboard?

For example this is some of the troublesome XML below

  <searchString>`SfeS-client-check-logs` | eval state=case(status_id=-1,"Error", status_id=0,"Disabled", status_id=1,"Running", status_id=2,"Running", status_id=3,"Stopping", status_id=4,"Restarting") | table state</searchString>

Found this from some previous XML Legacy notation answers on here however I cant quite get the fiddling around on the XML work


...what you put here only affects the research that is in the query tag.

Im still unsure exactly how to populate here even with the above explanation as still getting legacy notations or unexpected close arguments!

Kind Regards,

Thomas Brewster

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...