Building for the Splunk Platform

Splunk Enterprise 7.2.6 upgrade to 8.1 and python upgrade

abhic25
Explorer

I am planning to upgrade Splunk 7.2.6 to 8.1 and before that, i am planning a Python upgrade from 2.7 to 3. So when I ran the Splunk platform upgrade readiness app I got one private app called "Forward to Indexer" in our environment getting blocker and which shows 

Advance XML - Remove all usage of advance XML

File path - \Local/data/ui/view\sample_search.xml

\local/data/ui/view\sample_notimeline.xml

As i am not understanding How to deal with this XML, even I am not able to understand where is this app getting used and what is impact if that XML gets removed.

 

 

Labels (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

this apps seems to use some Advanced XML features and for that reason you have gotten this warning.

There are two options for you:

  1. Replace the functionality of this app/dashoards with Simple XML only
  2. If those dashboards are not needed just remove those

Which one is correct solution is depended of those dashboards.

You could post the codes here and we could try to help you, or just told the features which you are needing and we could try to told if there is already something which you could take into use instead of this app. Quite probably you could use MC (monitoring console) to get most important information about those forwarders?

r. Ismo

View solution in original post

abhic25
Explorer

@isoutamo Thanks for your response, I have pasted both XML files here

"SAmple_search.xml"

<view onunloadCancelJobs="False" autoCancelInterval="100">
<!-- autoCancelInterval is set here to 100 -->
<label>Sample search</label>
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="clearOnJobDispatch">False</param>
<param name="maxSize">1</param>
</module>
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useAssistant">true</param>
<param name="useTypeahead">true</param>
<param name="useOwnSubmitButton">False</param>
<module name="TimeRangePicker">
<param name="selected">All time</param>
<param name="searchWhenChanged">True</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<module name="Message" layoutPanel="graphArea">
<param name="filter">splunk.search.job</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">2</param>
<module name="JobStatus">
<param name="resultsLink">
<param name="popup">True</param>
<param name="viewTarget">report_builder_define_data</param>
<param name="transformedResultsViewTarget">report_builder_format_report</param>
</param>
<module name="FlashTimeline" layoutPanel="graphArea">
<param name="height">180px</param>
<param name="width">100%</param>
<module name="TitleBar" layoutPanel="viewHeader"/>
<module name="FieldPicker" layoutPanel="sidebar">
<param name="fields">host sourcetype source</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
<module name="Message" layoutPanel="resultsAreaLeft">
<param name="filter">pageControls</param>
<param name="clearOnJobDispatch">True</param>
<param name="maxSize">1</param>
</module>
<module name="Count" layoutPanel="pageControls">
<param name="options">
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="selected">True</param>
<param name="value">50</param>
</list>
</param>
<module name="ButtonSwitcher" layoutPanel="pageControls">
<param name="mode">independent</param>
<param name="selected">splIcon-events-list</param>
<param name="disableOnNull">True</param>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-list" altTitle="Events List">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="entityName">events</param>
<param name="maxPages">10</param>

<module name="SoftWrap" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="RowNumbers">
<module name="MaxLines">
<param name="options">
<list>
<param name="text">5</param>
<param name="selected">True</param>
<param name="value">5</param>
</list>
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="value">50</param>
</list>
<list>
<param name="text">100</param>
<param name="value">100</param>
</list>
<list>
<param name="text">200</param>
<param name="value">200</param>
</list>
<list>
<param name="text">All</param>
<param name="value">0</param>
</list>
</param>
<module name="Segmentation" >
<param name="options">
<list>
<param name="text">inner</param>
<param name="selected">True</param>
<param name="value">inner</param>
</list>
<list>
<param name="text">outer</param>
<param name="value">outer</param>
</list>
<list>
<param name="text">full</param>
<param name="value">full</param>
</list>
<list>
<param name="text">raw</param>
<param name="value">raw</param>
</list>
</param>
<module name="EventsViewer" layoutPanel="resultsAreaLeft">
<param name="segmentation">full</param>
<param name="reportFieldLink">report_builder_format_report</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>

<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-events-table" altTitle="Events Table">
<param name="entityLabel">events</param>
<param name="entityName">events</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">events</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">events</param>
</module>
</module>
</module>
</module>
</module>
<module name="ResultsHeader" layoutPanel="resultsHeaderPanel" group="splIcon-results-table" altTitle="Results Table">
<param name="entityLabel">results</param>
<param name="entityName">results</param>
<module name="EnablePreview" group="show" layoutPanel="resultsOptions">
<param name="enable">True</param>
<module name="Paginator" layoutPanel="pageControls">
<param name="count">50</param>
<param name="entityName">results</param>
<param name="maxPages">10</param>
<module name="RowNumbers" layoutPanel="resultsOptions">
<module name="DataOverlay" layoutPanel="resultsAreaLeft">
<module name="SimpleResultsTable" layoutPanel="resultsAreaLeft">
<param name="entityName">results</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="MultiFieldViewer">
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
<module name="SuggestedFieldViewer">
<param name="minDistinctCount">1</param>
<param name="minFrequency">0.5</param>
<param name="maxFields">50</param>
<param name="exclude">
<list>^date_.*</list>
</param>
<param name="link">
<param name="view">report_builder_format_report</param>
</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

 

"sample_notimeline.xml"

 

<!-- This view is the simplest search view. It includes a search bar and paged results.-->


<view onunloadCancelJobs="False" autoCancelInterval="100">
<label>Sample no timeline</label>

<!-- Top level navigation -->
<module name="AccountBar" layoutPanel="appHeader"/>
<module name="AppBar" layoutPanel="navigationHeader"/>

<!-- This module renders the search box -->
<module name="SearchBar" layoutPanel="splSearchControls-inline">
<param name="useOwnSubmitButton">False</param>
<module name="SubmitButton">
<param name="allowSoftSubmit">True</param>
<!-- You need paginator to page through all the results from the search -->
<module name="Paginator" layoutPanel="mainSearchControls">
<param name="entityName">events</param>
<!-- This module renders the resulting events from your search -->
<module name="EventsViewer" layoutPanel="mainSearchControls"/>
</module>
</module>
</module>
</view>

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

this apps seems to use some Advanced XML features and for that reason you have gotten this warning.

There are two options for you:

  1. Replace the functionality of this app/dashoards with Simple XML only
  2. If those dashboards are not needed just remove those

Which one is correct solution is depended of those dashboards.

You could post the codes here and we could try to help you, or just told the features which you are needing and we could try to told if there is already something which you could take into use instead of this app. Quite probably you could use MC (monitoring console) to get most important information about those forwarders?

r. Ismo

Get Updates on the Splunk Community!

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...