BUG Splunk 6.0.5: 2 panels in the simple XML dashboard will not load the same report. Why?

[the_wolverine]

I have a simple xml dashboard with 2 panels both referencing the same search. One panel displays it as a table, the other displays a chart. Splunk won't load both of them. Why?

I've scheduled the report to run every hour. One panel loads fine, the other displays a message: "waiting for data".

Here's the sample xml:

<dashboard>
  <label>my dashboard</label>
  <description/>

  <row>
    <chart>
      <title>My table</title>
      <searchName>my_search_123</searchName>
      <option name="charting.axisTitleX.visibility">collapsed</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">none</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">bottom</option>
      <option name="wrap">true</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">cell</option>
      <option name="count">10</option>
    </chart>
  </row>

  <row>
    <chart>
      <title>My Chart</title>
      <searchName>my_search_123</searchName>
      <option name="charting.axisTitleX.visibility">collapsed</option>
      <option name="charting.axisTitleY.visibility">collapsed</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">bottom</option>
    </chart>
  </row>
</dashboard>

[the_wolverine]

Dashboard panels are inconsistent when referencing the same SID (SPL-94886)

[the_wolverine · Accepted solution]

Solution (or workaround):
Convert Simple XML to Advanced XML and it works properly.

[the_wolverine]

This appears to be some kind of bug perhaps with simple XML. It doesn't make sense that the advanced Xml version of this dashboard would work and simple does not when Splunk is advising against using Advanced XML. I also have other issues with Simple XML that are being reported to Splunk now.

[ben_leung]

We have an open case with Splunk, case 207818. Hope the dev team can figure out why where the issue is coming from.

[RobertaRimondo]

Hi Ben, is there any update on this case?
I have the same problem described in this topic: two dashboard panels (one table and one drill down table) based on the same search, one displays data but the second often only shows the message "Waiting for data": I have to press the "Refresh" icon on the second panel to display the results.
Thanks!

[dmr195]

Do you have custom search commands in your base search? We have seen a problem intermittently of panels hanging with the message "Waiting for data" and suspect that it happens when the base search is slow to get going. We moved all our custom search commands out of the base search and into post processes (even though they're then duplicated in all the post processes) and it avoids the hang.

Having said that, maybe this problem of panels hanging intermittently is different to the problem of the original post, as the original post makes it sound like the hanging happened 100% of the time.