There is a bug I found when I convert my simple XML dashboard to HTML.
On my simple dashboard, I have a search like this, which displays correctly:
...
| rename totalRecs as "Total Records Out"
| table "Total Records Out"
...
But, when I convert my dashboard to HTML, my rename loses a character space. The search ends up causing me to have missing data for the "Total Records Out" column because it got renamed to "Total RecordsOut"
...
| rename totalRecs as "Total RecordsOut" ...
| table "Total Records Out"
...
I guess I didn't really have a question here, just a minor bug/inconvenience.
My original post might have been a little misleading, my simple xml searches were all on one line.
... | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
I didn't get a chance to try your idea because I had already made changes to that dashboard that I didn't want to lose. It seemed like when I added more search text before the rename, this behavior stopped
... | more search text | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
My original post might have been a little misleading, my simple xml searches were all on one line.
... | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
I didn't get a chance to try your idea because I had already made changes to that dashboard that I didn't want to lose. It seemed like when I added more search text before the rename, this behavior stopped
... | more search text | rename totalRecs as "Total Records Out" | table "Total Records Out" ...
@eroffol - that's one of the reasons I REALLY don't like to add spaces into a variable name, in any language. Way too much fiddly or squishy stuff happens. Okay, I'm moving your comment to an answer, and you can accept it when you get a chance. This is one of those things that unfortunately gets filed as "Unable to Reproduce".
Interesting. Just for kicks, you might reverse those two lines and see if it still happens, and which line it happens to. It worries me that where a line wraps might cause occasional random glitches... in which case any code change can introduce bugs elsewhere in the code.
I am using Splunk 6.2.3