Dashboards & Visualizations

Splunk 6.6.1 Can't modify search on dashboard

DavidHourani
Super Champion

Hello Splunkers,

On Splunk 6.6.1 when I modify a search on a panel in a dashboard then hit cancel or save, I can't modify other panels on the same dashboard unless I refresh the page...Is anyone else having this problem ?

Is it a visual bug or something ?

Regards,
David

Tags (1)

edavison
Explorer

So, in hopes this helps you (and potentially the future masses), I ended up going down the rabbit hole of browser javascript errors after exhausting review of internal logs, etc., and have emerged victorious!

TLDR: the v6.6.1 feature addition of "dashboard search edit enhancements" may break dashboard search editing if any installed search commands/functions fail to validate syntax. Review any custom search commands/functions in searchbnf.conf and remove or fix.

In my case it was a single app, "Splunk Query for Graphite" aka Carbonmine where the searchbnf.conf contains a typo in the "sytanx"...rather "syntax" parameter. This was not an easy item to identify as my browser was throwing errors which indicated dozens of potential problems none of which were the issue (I spent hours troubleshooting reverse proxy caching and auth tokens in vain).

Ultimately, in my case, it was the volume of POST requests coming back as failed that upon inspection showed the browser is attempting to validate each search parameter (for each search on dashboard...which generated a ton of errors). The part that is awful is Splunk is validating against EVERY command available to the user regardless of if it is used in the search! So even though NONE of my searches were using carbonmine's search commands, the entire feature crashed editing!

The current v6.6.1 common.js and mode-spl.js apparently do not handle these failures well and simply fail to recover. This in turn causes the behavior observed where you can edit a single panel's search configuration (though syntax highlighting will likely not work) but subsequent attempts fail to even load the edit modal.

browser_errors

edavison
Explorer

Any success in resolving the issue or identifying a cause? Just checking before I open an issue myself.

0 Karma

DavidHourani
Super Champion

Support said that some modified CSS could be causing this, so I tried to reset as much css as I could but still nothing...you're having the same issue ?

0 Karma

edavison
Explorer

I am and have had zero success pinpointing a culprit. I've got lots of evidence of the issue, but shy of debugging the "static/[build#]/build/pages/enterprise/common.js" and the rabbit holes that goes through I've not been able to identify a culprit.

I can confirm its in multiple browsers (regardless of clearing cache, etc.) and across all users. Its impacting panel search editing as well as syntax highlighting and even prevents copy and paste from working via right click!

0 Karma

woodcock
Esteemed Legend

Add the bug tag. Open a case with support. Try another browser.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...