After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

[yutaka1005]

My Splunk ver : v8.0
Server : Windows
Browser : chrome

When I re-change column color setting(* like Scale, Range) in table view after configured it once, <format> tags are duplicated.
Because of this, following message displayed, then I can't edit that setting on User Interface until delete <format> tag in Source.

Custom configuration. Edit from source

This isn't a big problem, but I think it's a bug in 8.0.
If anyone knows the workaround of this issue, please let me know.

[scottpestyk · Accepted solution]

Just as a heads up, this issue is probably the same as this issue that has been fixed and added to the 8.0.1 patch on Dec. 12th 2019:

Charting, reporting, and visualization issues
Date resolved: 2019-11-08

Issue number: SPL-179171, SPL-178113

Description: Editing color scale using colorpalette in dashboard creates custom configuration

I can't 100% confirm this fixes the issue, til I get a chance to try it out in a couple weeks.

But since it took me a while to find, I figured I'd add it to this page to hopefully help others.

[scottpestyk]

I had a chance to try it out a couple of days ago, and it worked.

Problem solved in my case, so hopefully everyone else's too.

[BasiliusCarver]

I have the same thing on SplunkCloud 7.2.9 this is how I can trigger it in chrome and safari (both without extensions enabled)
Starting with this dashboard xml:

<dashboard>
    <label>testing_bloated_xml</label>
    <row>
    <panel>
        <table>
        <search>
            <query>| makeresults 1
| eval thing1 = 1
| eval thing2 = 1</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        </table>
    </panel>
    </row>
</dashboard>

I just have to format the two columns quickly and then I end up with duplicated format tags for field "thing1".

This gets a lot worse with more columns as it exponentially blows out the dashboard xml until the dashboard starts lagging heavily.
Then I have to edit the xml to remove the duplicates which is pretty painful.

[BasiliusCarver]

I've also seen it happen when setting formatting in the "stats" tab of a normal search.

[BasiliusCarver]

I wrote a script to cleanup the xml I've been using. It's not tested very well but has saved me a bit of time https://github.com/BasiliusCarver/splunkformatdedup

[efavreau]

So have I in v7.2.8.

[keith_d]

Same in version 7.3.3 for setting up color formatting on columns in a normal Splunk search. I'm hopeful that once we get the latest 8.x version this will be fixed for us as well.

[yutaka1005]

Please somebody help me!

[niketn]

@yutaka1005 I have seen the same issue. Each time Table column in Splunk UI in 8.x is clicked for formatting, it adds a duplicate Simple XML code in the backend. Which stops subsequent editing from front-end and keeps adding Simple XML code in the back-end.

Only workaround would be to cleanup Simple XML code and format table column only once.

[yutaka1005]

@niketnilay

Thank you for comment.
Also thank you for comment on slack.

I was relieved that other people have experienced the same bug.