Splunk Dev

Splunk Enterprise 7.2.6 upgrade to 8.1 and python upgrade

abhic25
Explorer

I am planning to upgrade Splunk 7.2.6 to 8.1 and before that, i am planning a Python upgrade from 2.7 to 3. So when I ran the Splunk platform upgrade readiness app I got one private app called "Forward to Indexer" in our environment getting blocker and which shows 

Advance XML - Remove all usage of advance XML

File path - \Local/data/ui/view\sample_search.xml

\local/data/ui/view\sample_notimeline.xml

As i am not understanding How to deal with this XML, even I am not able to understand where is this app getting used and what is impact if that XML gets removed.

 

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

this apps seems to use some Advanced XML features and for that reason you have gotten this warning.

There are two options for you:

  1. Replace the functionality of this app/dashoards with Simple XML only
  2. If those dashboards are not needed just remove those

Which one is correct solution is depended of those dashboards.

You could post the codes here and we could try to help you, or just told the features which you are needing and we could try to told if there is already something which you could take into use instead of this app. Quite probably you could use MC (monitoring console) to get most important information about those forwarders?

r. Ismo

View solution in original post

abhic25
Explorer

@isoutamo Thanks for your response, I have pasted both XML files here

"SAmple_search.xml"

<view onunloadCancelJobs="False" autoCancelInterval="100">
<!-- autoCancelInterval is set here to 100 -->
<label>Sample search</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<param name="useOwnSubmitButton">False</param>
<module name="TimeRangePicker">
<param name="selected">All time</param>
<param name="searchWhenChanged">True</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<module name="Message" layoutPanel="graphArea">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">2</param>
<module name="JobStatus">
<param name="resultsLink">
<param name="popup">True</param>
<param name="viewTarget">report_builder_define_data</param>
<param name="transformedResultsViewTarget">report_builder_format_report</param>
</param>
<module name="FlashTimeline" layoutPanel="graphArea">
<param name="height">180px</param>
<param name="width">100%</param>
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
<module name="Message" layoutPanel="resultsAreaLeft">
<param name="filter">pageControls</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="Count" layoutPanel="pageControls">
<param name="options">
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="selected">True</param>
<param name="value">50</param>
</list>
</param>
<module name="ButtonSwitcher" layoutPanel="pageControls">
<param name="mode">independent</param>
<param name="selected">splIcon-events-list</param>
<param name="disableOnNull">True</param>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="entityName">events</param>
<param name="maxPages">10</param>

<module name="SoftWrap" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="RowNumbers">
<module name="MaxLines">
<param name="options">
<list>
<param name="text">5</param>
<param name="selected">True</param>
<param name="value">5</param>
</list>
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="value">50</param>
</list>
<list>
<param name="text">100</param>
<param name="value">100</param>
</list>
<list>
<param name="text">200</param>
<param name="value">200</param>
</list>
<list>
<param name="text">All</param>
<param name="value">0</param>
</list>
</param>
<module name="Segmentation" >
<param name="options">
<list>
<param name="text">inner</param>
<param name="selected">True</param>
<param name="value">inner</param>
</list>
<list>
<param name="text">outer</param>
<param name="value">outer</param>
</list>
<list>
<param name="text">full</param>
<param name="value">full</param>
</list>
<list>
<param name="text">raw</param>
<param name="value">raw</param>
</list>
</param>
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
<param name="segmentation">full</param>
<param name="reportFieldLink">report_builder_format_report</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>

<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">events</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">events</param>
</module>
</module>
</module>
</module>
</module>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
<param name="entityLabel">results</param>
<param name="entityName">results</param>
<module name="EnablePreview" group="show" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">results</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">results</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="MultiFieldViewer">
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
<module name="SuggestedFieldViewer">
<param name="minDistinctCount">1</param>
<param name="minFrequency">0.5</param>
<param name="maxFields">50</param>
<param name="exclude">
<list>^date_.*</list>
</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

 

"sample_notimeline.xml"

 

<!-- This view is the simplest search view. It includes a search bar and paged results.-->


<view onunloadCancelJobs="False" autoCancelInterval="100">
<label>Sample no timeline</label>

<!-- Top level navigation -->
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>

<!-- This module renders the search box -->
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useOwnSubmitButton">False</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<!-- You need paginator to page through all the results from the search -->
<module name="Paginator" layoutPanel="mainSearchControls">
<param name="entityName">events</param>
<!-- This module renders the resulting events from your search -->
<module name="EventsViewer" layoutPanel="mainSearchControls"/>
</module>
</module>
</module>
</view>

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this apps seems to use some Advanced XML features and for that reason you have gotten this warning.

There are two options for you:

  1. Replace the functionality of this app/dashoards with Simple XML only
  2. If those dashboards are not needed just remove those

Which one is correct solution is depended of those dashboards.

You could post the codes here and we could try to help you, or just told the features which you are needing and we could try to told if there is already something which you could take into use instead of this app. Quite probably you could use MC (monitoring console) to get most important information about those forwarders?

r. Ismo

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...