Hello Splunkers,
On Splunk 6.6.1 when I modify a search on a panel in a dashboard then hit cancel or save, I can't modify other panels on the same dashboard unless I refresh the page...Is anyone else having this problem ?
Is it a visual bug or something ?
Regards,
David
So, in hopes this helps you (and potentially the future masses), I ended up going down the rabbit hole of browser javascript errors after exhausting review of internal logs, etc., and have emerged victorious!
TLDR: the v6.6.1 feature addition of "dashboard search edit enhancements" may break dashboard search editing if any installed search commands/functions fail to validate syntax. Review any custom search commands/functions in searchbnf.conf and remove or fix.
In my case it was a single app, "Splunk Query for Graphite" aka Carbonmine where the searchbnf.conf contains a typo in the "sytanx"...rather "syntax" parameter. This was not an easy item to identify as my browser was throwing errors which indicated dozens of potential problems none of which were the issue (I spent hours troubleshooting reverse proxy caching and auth tokens in vain).
Ultimately, in my case, it was the volume of POST requests coming back as failed that upon inspection showed the browser is attempting to validate each search parameter (for each search on dashboard...which generated a ton of errors). The part that is awful is Splunk is validating against EVERY command available to the user regardless of if it is used in the search! So even though NONE of my searches were using carbonmine's search commands, the entire feature crashed editing!
The current v6.6.1 common.js and mode-spl.js apparently do not handle these failures well and simply fail to recover. This in turn causes the behavior observed where you can edit a single panel's search configuration (though syntax highlighting will likely not work) but subsequent attempts fail to even load the edit modal.
Any success in resolving the issue or identifying a cause? Just checking before I open an issue myself.
Support said that some modified CSS could be causing this, so I tried to reset as much css as I could but still nothing...you're having the same issue ?
I am and have had zero success pinpointing a culprit. I've got lots of evidence of the issue, but shy of debugging the "static/[build#]/build/pages/enterprise/common.js" and the rabbit holes that goes through I've not been able to identify a culprit.
I can confirm its in multiple browsers (regardless of clearing cache, etc.) and across all users. Its impacting panel search editing as well as syntax highlighting and even prevents copy and paste from working via right click!
Add the bug
tag. Open a case with support. Try another browser.