Dashboards & Visualizations

After upgrading to Splunk 6.5, why are dashboards not loading with error "could not create search"?

RAYUDU_NARA
Explorer

Hi Team,

We have upgraded Splunk from version 6.2.4 to 6.5 , after this change we are facing some issues with dashboard.
For all dashboards it is showing an error "could not create search" .
Kindly help me on this as priority, this issue is in Splunk production environment.

Thanks in advance.
Rayudu

Tags (2)
0 Karma

hardikJsheth
Motivator

There have been major upgrade in the UI framework with 6.5. In earlier version it was allowed to write elements as

 <input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default/>
    </input>

But with 6.5 , you must write it as follows:

<input id="user_id" token="user_form" type="text">
      <label>User</label>
      <default></default>
    </input>

This can be one of the reason if your dashboard was working fine with Splunk <6.5

0 Karma

@RAYUDU_NARA can you please send dashboard's XML snippet for search being used in your dashboards? If you are on 6.2.4 and using populatingSearch for your queries, you can change search instead. Refer to following documentation for Simple XML deprecated commands.

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/PanelreferenceforSimplifiedXML#Search_elements...

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

RAYUDU_NARA
Explorer

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

0 Karma

@RAYUDU_NARA... so seems like some required capability is missing. Have you checked whether you can run the searches in the dashboard directly from Splunk Search or is it only dashboard which is not working?

Your Splunk admin should revisit concurrent search settings and jobs disc quota for Power User role. Also revisit the capabilities and searchable index. Not sure though as to how migration would have impacted this.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

you can run the searches that populate the dashboards in the search window?
can you give an example of a dashboard XML that isn't working?

0 Karma

RAYUDU_NARA
Explorer

Hi ,

Thanks for your suggestions.
Dash board and everything working fine but for mine and my colleague user access is not working after this upgrade of splunk. We are in power admin groups but not able to do any activities in splunk console.

Thanks,
Rayudu

0 Karma

adonio
Ultra Champion

try to clear all cookies and cache from browser

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...