After upgrading to Splunk 6.5, why are dashboards not loading with error "could not create search"?

[RAYUDU_NARA]

Hi Team,

We have upgraded Splunk from version 6.2.4 to 6.5 , after this change we are facing some issues with dashboard.
For all dashboards it is showing an error "could not create search" .
Kindly help me on this as priority, this issue is in Splunk production environment.

Thanks in advance.
Rayudu

[hardikJsheth]

There have been major upgrade in the UI framework with 6.5. In earlier version it was allowed to write elements as

 <input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default/>
    </input>

But with 6.5 , you must write it as follows:

<input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default></default>
    </input>

This can be one of the reason if your dashboard was working fine with Splunk <6.5

[niketn]

@RAYUDU_NARA can you please send dashboard's XML snippet for search being used in your dashboards? If you are on 6.2.4 and using populatingSearch for your queries, you can change search instead. Refer to following documentation for Simple XML deprecated commands.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/PanelreferenceforSimplifiedXML#Search_elements...

[RAYUDU_NARA]

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

[niketn]

@RAYUDU_NARA... so seems like some required capability is missing. Have you checked whether you can run the searches in the dashboard directly from Splunk Search or is it only dashboard which is not working?

Your Splunk admin should revisit concurrent search settings and jobs disc quota for Power User role. Also revisit the capabilities and searchable index. Not sure though as to how migration would have impacted this.

[cmerriman]

you can run the searches that populate the dashboards in the search window?
can you give an example of a dashboard XML that isn't working?

[RAYUDU_NARA]

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

[adonio]

try to clear all cookies and cache from browser