Simple XML "set token" was removed suddenly.It's happend frequently, although I did not change it .

[Shuhei052492]

Hi,

I have a issue about the XML setting.
I set this following setting of "default".But often the and elements were removed.
Not only "thistime" but also the value of "now_time" and "workerlist" were removed.

Does anyone have same case? OR know the cause of it?
This is the folling XML which was often changed.

Regards,

Before(defalut)

    <panel>
      <title>testt title($tok_this_time$ )</title>
      <single>
        <title>Japanese comment</title>
        <search>
          <query>index="test" sourcetype=test
#########Abbreviated search##########
| stats count values(maxtime) as thistime values(maxtime2) as now_time values(list) as wlist
| eval workerlist=mvjoin(wlist," OR ")</query>
          <finalized>
            <condition>
              <set token="tok_this_time">$result.thistime$</set>
              <set token="tok_now_time">$result.now_time$</set>
              <set token="tok_now_worker">$result.workerlist$</set>
            </condition>
          </finalized>
          <earliest>-3mon@mon</earliest>
          <latest>now</latest>
        </search>
        <option name="afterLabel">回</option>
        <option name="beforeLabel">超過回数</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">55</option>
        <option name="rangeColors">["0x65a637","0xFFD700","0xd93f3c"]</option>
        <option name="rangeValues">[0,30]</option>
        <option name="refresh.display">preview</option>
        <option name="useColors">1</option>
        <drilldown>
          <link target="_blank">#########Abbreviated path##########</link>
        </drilldown>
      </single>
    </panel>

After

    <panel>
      <title>testt title($tok_this_time$ )</title>
      <single>
        <title>Japanese comment</title>
        <search>
          <query>index="test" sourcetype=test
#########Abbreviated search##########
| stats count values(maxtime) as thistime values(maxtime2) as now_time values(list) as wlist
| eval workerlist=mvjoin(wlist," OR ")</query>
          <earliest>-3mon@mon</earliest>
          <latest>now</latest>
        </search>
        <option name="afterLabel">回</option>
        <option name="beforeLabel">超過回数</option>
        <option name="colorMode">block</option>
        <option name="drilldown">all</option>
        <option name="height">55</option>
        <option name="rangeColors">["0x65a637","0xFFD700","0xd93f3c"]</option>
        <option name="rangeValues">[0,30]</option>
        <option name="refresh.display">preview</option>
        <option name="useColors">1</option>
        <drilldown>
          <link target="_blank">#########Abbreviated path##########</link>
        </drilldown>
      </single>
    </panel>

[niketn · Accepted solution]

@Shuhei052492, I believe if you are on Splunk Enterprise above 6.5, this is a known bug that Search Event Handler disappears on Editing the Panel through UI. I have noticed this issue on Splunk Enterprise 7.0, but think it is also possible in 6.6.

Please add BUG tag to this question of yours and also follow the question attached herewith so that you get an update from @agoyal who has raised the bug ( SPL-147251 ) :
https://answers.splunk.com/answers/596210/why-done-tag-is-disappeared-when-i-edit-panels-sea.html

[Shuhei052492]

Sorry for replying late.
Thank you for your opinion and answer.

This issue is happening on Splunk Enterprise above 6.6.3.
So now I am editing my dashboard carefully.
By the way, I researched "SPL-147251" in Known issue and did not find its article.
If you know the page related with "SPL-147251", Please let me know.

Sincerely,

[niketn]

@Shuhei052492, sorry I do not have access to look into Splunk Bugs. You might have to contact @agoyal. I would request you to upvote his question and also follow the same for any updates from Splunk team. I also find this issue disturbing as by mistake if I go to Dashboard source code in Edit Mode, I loose all the changes done to Search Event Handler. Which implies dashboard backup is always required before editing/making even minor changes.

[hidemaru2]

The "finalized" attribute may not be supported because it is not described in the manual in version 6.5 or later.
Why do not you try using "progress"?

[Shuhei052492]

Thank you for answering.
I tried setting "progress", however this issue happened again....
Maybe, this workaround is just be careful to edit a dashboard.

Regards,