Splunk Enterprise 7.2.6 upgrade to 8.1 and python upgrade

[abhic25]

I am planning to upgrade Splunk 7.2.6 to 8.1 and before that, i am planning a Python upgrade from 2.7 to 3. So when I ran the Splunk platform upgrade readiness app I got one private app called "Forward to Indexer" in our environment getting blocker and which shows 

Advance XML - Remove all usage of advance XML

File path - \Local/data/ui/view\sample_search.xml

\local/data/ui/view\sample_notimeline.xml

As i am not understanding How to deal with this XML, even I am not able to understand where is this app getting used and what is impact if that XML gets removed.

[abhic25]

@isoutamo Thanks for your response, I have pasted both XML files here

"SAmple_search.xml"

<view onunloadCancelJobs="False" autoCancelInterval="100">
<!-- autoCancelInterval is set here to 100 -->
<label>Sample search</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<param name="useOwnSubmitButton">False</param>
<module name="TimeRangePicker">
<param name="selected">All time</param>
<param name="searchWhenChanged">True</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<module name="Message" layoutPanel="graphArea">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">2</param>
<module name="JobStatus">
<param name="resultsLink">
<param name="popup">True</param>
<param name="viewTarget">report_builder_define_data</param>
<param name="transformedResultsViewTarget">report_builder_format_report</param>
</param>
<module name="FlashTimeline" layoutPanel="graphArea">
<param name="height">180px</param>
<param name="width">100%</param>
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
<module name="Message" layoutPanel="resultsAreaLeft">
<param name="filter">pageControls</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="Count" layoutPanel="pageControls">
<param name="options">
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="selected">True</param>
<param name="value">50</param>
</list>
</param>
<module name="ButtonSwitcher" layoutPanel="pageControls">
<param name="mode">independent</param>
<param name="selected">splIcon-events-list</param>
<param name="disableOnNull">True</param>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="entityName">events</param>
<param name="maxPages">10</param>

<module name="SoftWrap" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="RowNumbers">
<module name="MaxLines">
<param name="options">
<list>
<param name="text">5</param>
<param name="selected">True</param>
<param name="value">5</param>
</list>
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="value">50</param>
</list>
<list>
<param name="text">100</param>
<param name="value">100</param>
</list>
<list>
<param name="text">200</param>
<param name="value">200</param>
</list>
<list>
<param name="text">All</param>
<param name="value">0</param>
</list>
</param>
<module name="Segmentation" >
<param name="options">
<list>
<param name="text">inner</param>
<param name="selected">True</param>
<param name="value">inner</param>
</list>
<list>
<param name="text">outer</param>
<param name="value">outer</param>
</list>
<list>
<param name="text">full</param>
<param name="value">full</param>
</list>
<list>
<param name="text">raw</param>
<param name="value">raw</param>
</list>
</param>
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
<param name="segmentation">full</param>
<param name="reportFieldLink">report_builder_format_report</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>

<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">events</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">events</param>
</module>
</module>
</module>
</module>
</module>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
<param name="entityLabel">results</param>
<param name="entityName">results</param>
<module name="EnablePreview" group="show" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">results</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">results</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="MultiFieldViewer">
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
<module name="SuggestedFieldViewer">
<param name="minDistinctCount">1</param>
<param name="minFrequency">0.5</param>
<param name="maxFields">50</param>
<param name="exclude">
<list>^date_.*</list>
</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

"sample_notimeline.xml"

<!-- This view is the simplest search view. It includes a search bar and paged results.-->

<view onunloadCancelJobs="False" autoCancelInterval="100">
<label>Sample no timeline</label>

<!-- Top level navigation -->
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>

<!-- This module renders the search box -->
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useOwnSubmitButton">False</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<!-- You need paginator to page through all the results from the search -->
<module name="Paginator" layoutPanel="mainSearchControls">
<param name="entityName">events</param>
<!-- This module renders the resulting events from your search -->
<module name="EventsViewer" layoutPanel="mainSearchControls"/>
</module>
</module>
</module>
</view>

[isoutamo · Accepted solution]

Hi

this apps seems to use some Advanced XML features and for that reason you have gotten this warning.

There are two options for you:

1. Replace the functionality of this app/dashoards with Simple XML only
2. If those dashboards are not needed just remove those

Which one is correct solution is depended of those dashboards.

You could post the codes here and we could try to help you, or just told the features which you are needing and we could try to told if there is already something which you could take into use instead of this app. Quite probably you could use MC (monitoring console) to get most important information about those forwarders?

r. Ismo