Adding searchTemplate causes dashboard to disappear

[msarro]

Hey everyone. I have a dashboard which was set up with around 8 searches, each using its own search. The dashboard works correctly. I have created a clone to do testing with, and have tested that the clone works. I am now trying to trim this back into using a single search and several post processes. According to the documentation I am doing everything right.

So far I switched all of the "searchTemplate" tags to "searchPostProcess" and removed the overlapping search (basically the search index=x sourcetype=y) portion. I saved and the form still loads fine. But then as soon as I add the tags in the beginning of the form search, the dashboard disappears from my app. If I remove those tags, it suddenly re-appears. I have checked with an xml syntax checker and there aren't any errors.

Here is the beginning of my dash:

<form>
    <label>BCV IMS Customer Experience Dashboard (Simple)</label>
    <searchTemplate>
        index=xs XS_Calling_Number="*$TN$" OR XS_Called_Number="*$TN$" OR XS_Group_Number="*$TN$"|rex field=XS_Local_Call_ID "(?P&lt;XS_Local_Call_ID_Trimmed&gt;\d+)(?=:)"
    </searchTemplate>
    <fieldset>
        <input type="text" token="TN">
            <label>Enter Customer 10-Digit TN</label>
            <default></default>
            <seed></seed>
        </input>
        <input type="time" />
    </fieldset>
    <row>
...

Any thoughts? I am going to be opening a service ticket as well but was hoping I may get a faster answer here.

[sideview]

I don't know of any explanation for this better than what's in the UI Examples app. But if you read through the "simple xml" examples for form searches in there, you'll get a better understanding.

Basically the <form> flavor of simple xml has some unintuitive boundaries past which it will stop working like this. You can have either a "normal" form or what I think it calls an "inverted flow" form. What you've tried to do here is have somewhat of a hybrid. And when the python sees some simple xml form syntax that it doesn't like, it just yanks the view from the system. There might be a stack trace in splunk_web_service.log but I'm not sure how informative it would be.

So to get to points beyond those two simple <form> flavors, that's one of the reasons people switch to the advanced xml.

And as a piece of extra advice, if you're going to make the leap over to advanced XML you should get to know Sideview Utils at the same time. simple XML is easy but limited, advanced xml with sideview utils is weird but powerful. And in the middle the advanced XML without sideview utils is more complicated than either.

[msarro]

So I started pulling apart the search and I noticed that the issue only occurred when i had more than 1 element listed within the dashboard. Is there any way to use a default search for the majority of panels, but then in one or two other panels not use it?