Dashboards & Visualizations

Dashboard not loading with error, "totalQuery is undefined"

sylim_splunk
Splunk Employee
Splunk Employee

Some of my dashboards are not loading after the 7.3.x upgrade - which were all Okay with the previous version was 7.2.6.
The error messages are different from browsers but common thing is, the dashboards are not loading with the errors.
Errors are, as below with invalid line numbers.

totalQuery is undefined or

undefined is not an object (evaluating 'totalQuery.replace')

Tags (1)
1 Solution

sylim_splunk
Splunk Employee
Splunk Employee

This is caused by some post-process searches, such as if a post-process search doesn't contain <query> element, then dashboard is not loading. This is due to JavaScript undefined error. And can be worked around by adding empty query element for the post-process searches without query. This is just a temp workaround and may not be needed once fixed (7.3.4+, 8.0.1+).

for example, below is Okay
<search base="callsA" id="myTable">
<query>
| search call_id="$token1$"
...<SNIP>
</query>
</search>

But if a post-process search doesn't have any query but only has some options, which will cause the error/symptoms (SPL-178012).
<search base="callB" id="yourTable"></search>

It can be worked around by adding empty query element as below.

<search base="callB" id="yourTable">
<query></query>
</search>

View solution in original post

sylim_splunk
Splunk Employee
Splunk Employee

This is caused by some post-process searches, such as if a post-process search doesn't contain <query> element, then dashboard is not loading. This is due to JavaScript undefined error. And can be worked around by adding empty query element for the post-process searches without query. This is just a temp workaround and may not be needed once fixed (7.3.4+, 8.0.1+).

for example, below is Okay
<search base="callsA" id="myTable">
<query>
| search call_id="$token1$"
...<SNIP>
</query>
</search>

But if a post-process search doesn't have any query but only has some options, which will cause the error/symptoms (SPL-178012).
<search base="callB" id="yourTable"></search>

It can be worked around by adding empty query element as below.

<search base="callB" id="yourTable">
<query></query>
</search>

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...