All Apps and Add-ons

estreamer dashboard XML validation errors

New Member

Morning All,

Popped onto the estreamer dashboard this morning in our Splunk Cloud environment ( and noticed none of the metrics/statistics were populating.

Checking into the dashboard code itself and can see validation warnings specifically in relation to 'legacy notation' or 'unknown option name' - I was under the impression that a Splunk app updated automatically within the Splunk environment? is there a way to update the notations/options so Splunk can then populate the dashboard?

For example this is some of the troublesome XML below

  <searchString>`SfeS-client-check-logs` | eval state=case(status_id=-1,"Error", status_id=0,"Disabled", status_id=1,"Running", status_id=2,"Running", status_id=3,"Stopping", status_id=4,"Restarting") | table state</searchString>

Found this from some previous XML Legacy notation answers on here however I cant quite get the fiddling around on the XML work


...what you put here only affects the research that is in the query tag.

Im still unsure exactly how to populate here even with the above explanation as still getting legacy notations or unexpected close arguments!

Kind Regards,

Thomas Brewster

0 Karma