Dashboards & Visualizations

BUG Splunk 6.0.5: 2 panels in the simple XML dashboard will not load the same report. Why?

the_wolverine
Champion

I have a simple xml dashboard with 2 panels both referencing the same search. One panel displays it as a table, the other displays a chart. Splunk won't load both of them. Why?

I've scheduled the report to run every hour. One panel loads fine, the other displays a message: "waiting for data".

Here's the sample xml:

<dashboard>
  <label>my dashboard</label>
  <description/>

  <row>
    <chart>
      <title>My table</title>
      <searchName>my_search_123</searchName>
      <option name="charting.axisTitleX.visibility">collapsed</option>
      <option name="charting.axisTitleY.visibility">visible</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">none</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">bottom</option>
      <option name="wrap">true</option>
      <option name="rowNumbers">false</option>
      <option name="dataOverlayMode">none</option>
      <option name="drilldown">cell</option>
      <option name="count">10</option>
    </chart>
  </row>

  <row>
    <chart>
      <title>My Chart</title>
      <searchName>my_search_123</searchName>
      <option name="charting.axisTitleX.visibility">collapsed</option>
      <option name="charting.axisTitleY.visibility">collapsed</option>
      <option name="charting.axisX.scale">linear</option>
      <option name="charting.axisY.scale">linear</option>
      <option name="charting.chart">column</option>
      <option name="charting.chart.nullValueMode">gaps</option>
      <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
      <option name="charting.chart.stackMode">default</option>
      <option name="charting.chart.style">shiny</option>
      <option name="charting.drilldown">all</option>
      <option name="charting.layout.splitSeries">0</option>
      <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
      <option name="charting.legend.placement">bottom</option>
    </chart>
  </row>
</dashboard>
1 Solution

the_wolverine
Champion

Solution (or workaround):
Convert Simple XML to Advanced XML and it works properly.

View solution in original post

the_wolverine
Champion

Dashboard panels are inconsistent when referencing the same SID (SPL-94886)

0 Karma

the_wolverine
Champion

Solution (or workaround):
Convert Simple XML to Advanced XML and it works properly.

the_wolverine
Champion

This appears to be some kind of bug perhaps with simple XML. It doesn't make sense that the advanced Xml version of this dashboard would work and simple does not when Splunk is advising against using Advanced XML. I also have other issues with Simple XML that are being reported to Splunk now.

0 Karma

ben_leung
Builder

We have an open case with Splunk, case 207818. Hope the dev team can figure out why where the issue is coming from.

0 Karma

RobertaRimondo
Explorer

Hi Ben, is there any update on this case?
I have the same problem described in this topic: two dashboard panels (one table and one drill down table) based on the same search, one displays data but the second often only shows the message "Waiting for data": I have to press the "Refresh" icon on the second panel to display the results.
Thanks!

0 Karma

dmr195
Communicator

Do you have custom search commands in your base search? We have seen a problem intermittently of panels hanging with the message "Waiting for data" and suspect that it happens when the base search is slow to get going. We moved all our custom search commands out of the base search and into post processes (even though they're then duplicated in all the post processes) and it avoids the hang.

Having said that, maybe this problem of panels hanging intermittently is different to the problem of the original post, as the original post makes it sound like the hanging happened 100% of the time.

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...