Dashboards & Visualizations

How to upgrade Advanced XML file to simple XML file ?

tarunmalhotra79
Engager

Hi Team,

I am in a process of updating Splunk to version 8.0 and to Python 3.X.Also, for that I have remove all the usage of Advanced XML and convert it into the simple XML views.
But there are few dashboards/XML which seems to be impossible to convert them back to simple XML.

Could you please guide me the way how can i actually remove advance XML ? Or any kind of leads would be highly appreciated because manually changing them back to simple XML seems like a very tedious task.

For ex:-

APP Name:- Splunk Add for *Nix
Location:- tc_matrix_nix/default/data/ui/views/Setup.xml

Setup.XML

<view autoCancelInterval="100" template="search.html">
  <label>Splunk for Unix Add-on: Setup</label>

  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  </module>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  </module>
  <module name="TA_Unix_FTR" layoutPanel="viewHeader">
  </module>

  <module name="TA_Unix_IFrame" layoutPanel="viewHeader">
    <param name="height">auto</param>
  </module>
</view>

Thanks in advance

0 Karma

rbardonetorian
Path Finder

convert from XML to html i believe is a current capability from the create dashboard UI.

0 Karma

snallam123
Path Finder

stuck with same issue, I think we cannot. Its easy to create new dashboards from your spl query than completely fixing xml

0 Karma

13tsavage
Communicator

Currently from my investigating into this matter, there are no guides on converting advanced xml back to simple xml. Only reference I read can be found from the Changes to Splunk Enterprise

  • *Advanced XML (deprecated in Splunk version 6.3): removed. If possible, replace Advanced XML with Simple XML. For more information about alternatives to Advanced XML available in Splunk Enterprise, see Building customizations for the Splunk platform *
0 Karma

nickhills
Ultra Champion

setup.xml is a special case. I'm pretty sure you don't want to modify that, as its not a dashboard per-se

From this looks of this, you have a customised version of the Splunk provided *nix app.
Have you looked at the latest version from Splunkbase to identify what has changed.

Seems a lot of work to rebuild everything, and loose the convinence of a Splunk curated app.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...