Dashboards & Visualizations

Custom App update not getting used by Splunk dashboard

cmuesing
Engager

Our custom app had changes to the views and these changes are not getting updated. I have zipped the custom app and followed the install from file process. The custom app passed the AppInspection version 3.0.3 after I figured out how to run the slim generate-manifest command. It took a few tries to get it correct, but I have uploaded this custom app to Splunk Cloud. When I use the app, I expect the latest xml code for our custom views to be used, but the data is not displaying correctly in the chart. When I click on Open in search icon, I get an old version of the view search query, so that explains why the chart looks funny. 

Has anyone dealt with this before? Are there tricks to clearing out the obsolete views when uploading a new version? I have incremented the minor and release versions, based on other reasons. I do know the cloud expects the versions to increment. Our last working version was 1.0.115 and my current version is 1.1.7. 

Labels (2)
0 Karma

dtburrows3
Builder

Sounds like you may have the old version still lingering around in <app>/local/data/ui/views/



0 Karma

cmuesing
Engager

Thank you dtburrows3. I thought the same thing but didn't know how to find what was being loaded on the Cloud. I don't know of a btool option in the cloud for a custom app. Our developer created this custom app with everything in the default folder, so local wasn't a path we were deploying. I finally realized that we possibly created a local folder ourselves in the GUI when someone went into the Manage Apps, view objects and edited the XML. I have modified it there manually to resolve the problem, but I want to delete the local view completely, and it didn't get removed when I uploaded a new release of the custom app to the Splunk Cloud. 

Does anyone know how to delete a file from an app in Splunk Cloud?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...