Lots of my dashboard panels in simple XML are no longer working since upgrading to 6.5. Getting "No results found." But when I open up in search the SPL work fine with lots of results.
Issue appears to be tab characters in my SPL.
<search base="baseSearch_wwan_connectfailure">
<query>stats count as Failures by car
| sort-Failures
| rename car as "Carrier"
</query>
If I replace the tab characters with spaces all is working again.
Anyone else seeing this issue?
Replacing all tab characters with spaces in my XML files fixed the issue.
Hi @simpkins1958,
Our engineering team has been looking into this and we were able to reproduce the behavior today. From what I can tell, this issue does not occur if you are creating or editing a dashboard within the Dashboard Editor interface in Splunk Web, but it might occur if another editor, such as VIM, is used. We're going to investigate this further.
We've filed a ticket to track this as a bug/known issue and look into a fix in an upcoming version. Thanks for posting your notes and the workaround!
Per support, this bug is SPL-131250, and was resolved as of 6.5.2. It specifically only broke simple xml dashboards which had TAB characters.
Weird. I too have had some issues with 6.5 SimpleXML, but unrelated to this. I will be on the lookout for anything similar and will report to the Splunk team.
I have not seen this issue and I use tabs a lot. What browser are you using to access the dashboards? Are your SimpleXML files in UTF-8 / ASCII format?
Seeing the issue in latest versions of Chrome and IE. XML files are ASCII format.
Also, when you click Edit -> Source, does Splunk show any Validation errors or warnings XML? This is a new feature in 6.5 that has become very handy.
Nope no validation errors.
All works when I change tabs to spaces.
what do you see when you look at the job inspector? does it look like the job inspector show the searches in what looks like a reasonably accurate translation for the litsearch field?
See the screen shot I just attached. Job inspector is reporting 40K+ events.