Dashboards & Visualizations

After upgrading to Splunk8.0, when I re-change column color setting in table view, "format" tags are duplicated.

yutaka1005
Builder

My Splunk ver : v8.0
Server : Windows
Browser : chrome

When I re-change column color setting(* like Scale, Range) in table view after configured it once, <format> tags are duplicated.
Because of this, following message displayed, then I can't edit that setting on User Interface until delete <format> tag in Source.

Custom configuration. Edit from source

This isn't a big problem, but I think it's a bug in 8.0.
If anyone knows the workaround of this issue, please let me know.

1 Solution

scottpestyk
Engager

Just as a heads up, this issue is probably the same as this issue that has been fixed and added to the 8.0.1 patch on Dec. 12th 2019:

Charting, reporting, and visualization issues
Date resolved: 2019-11-08

Issue number: SPL-179171, SPL-178113

Description: Editing color scale using colorpalette in dashboard creates custom configuration

I can't 100% confirm this fixes the issue, til I get a chance to try it out in a couple weeks.

But since it took me a while to find, I figured I'd add it to this page to hopefully help others.

View solution in original post

scottpestyk
Engager

Just as a heads up, this issue is probably the same as this issue that has been fixed and added to the 8.0.1 patch on Dec. 12th 2019:

Charting, reporting, and visualization issues
Date resolved: 2019-11-08

Issue number: SPL-179171, SPL-178113

Description: Editing color scale using colorpalette in dashboard creates custom configuration

I can't 100% confirm this fixes the issue, til I get a chance to try it out in a couple weeks.

But since it took me a while to find, I figured I'd add it to this page to hopefully help others.

scottpestyk
Engager

I had a chance to try it out a couple of days ago, and it worked.

Problem solved in my case, so hopefully everyone else's too.

0 Karma

BasiliusCarver
Explorer

I have the same thing on SplunkCloud 7.2.9 this is how I can trigger it in chrome and safari (both without extensions enabled)
Starting with this dashboard xml:

<dashboard>
    <label>testing_bloated_xml</label>
    <row>
    <panel>
        <table>
        <search>
            <query>| makeresults 1
| eval thing1 = 1
| eval thing2 = 1</query>
            <earliest>-15m</earliest>
            <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
        </table>
    </panel>
    </row>
</dashboard>

I just have to format the two columns quickly and then I end up with duplicated format tags for field "thing1".
https://imgur.com/a/f49UVty

This gets a lot worse with more columns as it exponentially blows out the dashboard xml until the dashboard starts lagging heavily.
Then I have to edit the xml to remove the duplicates which is pretty painful.

BasiliusCarver
Explorer

I've also seen it happen when setting formatting in the "stats" tab of a normal search.

BasiliusCarver
Explorer

I wrote a script to cleanup the xml I've been using. It's not tested very well but has saved me a bit of time https://github.com/BasiliusCarver/splunkformatdedup

0 Karma

efavreau
Motivator

So have I in v7.2.8.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

keith_d
Explorer

Same in version 7.3.3 for setting up color formatting on columns in a normal Splunk search. I'm hopeful that once we get the latest 8.x version this will be fixed for us as well.

0 Karma

yutaka1005
Builder

Please somebody help me!

0 Karma

niketn
Legend

@yutaka1005 I have seen the same issue. Each time Table column in Splunk UI in 8.x is clicked for formatting, it adds a duplicate Simple XML code in the backend. Which stops subsequent editing from front-end and keeps adding Simple XML code in the back-end.

Only workaround would be to cleanup Simple XML code and format table column only once.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

yutaka1005
Builder

@niketnilay

Thank you for comment.
Also thank you for comment on slack.

I was relieved that other people have experienced the same bug.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...