Dashboards & Visualizations

Dashboard not loading with error, "totalQuery is undefined"

sylim_splunk
Splunk Employee
Splunk Employee

Some of my dashboards are not loading after the 7.3.x upgrade - which were all Okay with the previous version was 7.2.6.
The error messages are different from browsers but common thing is, the dashboards are not loading with the errors.
Errors are, as below with invalid line numbers.

totalQuery is undefined or

undefined is not an object (evaluating 'totalQuery.replace')

Tags (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This is caused by some post-process searches, such as if a post-process search doesn't contain <query> element, then dashboard is not loading. This is due to JavaScript undefined error. And can be worked around by adding empty query element for the post-process searches without query. This is just a temp workaround and may not be needed once fixed (7.3.4+, 8.0.1+).

for example, below is Okay
<search base="callsA" id="myTable">
<query>
| search call_id="$token1$"
...<SNIP>
</query>
</search>

But if a post-process search doesn't have any query but only has some options, which will cause the error/symptoms (SPL-178012).
<search base="callB" id="yourTable"></search>

It can be worked around by adding empty query element as below.

<search base="callB" id="yourTable">
<query></query>
</search>

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This is caused by some post-process searches, such as if a post-process search doesn't contain <query> element, then dashboard is not loading. This is due to JavaScript undefined error. And can be worked around by adding empty query element for the post-process searches without query. This is just a temp workaround and may not be needed once fixed (7.3.4+, 8.0.1+).

for example, below is Okay
<search base="callsA" id="myTable">
<query>
| search call_id="$token1$"
...<SNIP>
</query>
</search>

But if a post-process search doesn't have any query but only has some options, which will cause the error/symptoms (SPL-178012).
<search base="callB" id="yourTable"></search>

It can be worked around by adding empty query element as below.

<search base="callB" id="yourTable">
<query></query>
</search>

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...