Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

[simpkins1958]

Lots of my dashboard panels in simple XML are no longer working since upgrading to 6.5. Getting "No results found." But when I open up in search the SPL work fine with lots of results.

Issue appears to be tab characters in my SPL.

    <search base="baseSearch_wwan_connectfailure">
      <query>stats count as Failures by car 
           | sort-Failures 
           | rename car as "Carrier"
      </query>

If I replace the tab characters with spaces all is working again.

Anyone else seeing this issue?

[simpkins1958]

Replacing all tab characters with spaces in my XML files fixed the issue.

[frobinson_splun]

Hi @simpkins1958,
Our engineering team has been looking into this and we were able to reproduce the behavior today. From what I can tell, this issue does not occur if you are creating or editing a dashboard within the Dashboard Editor interface in Splunk Web, but it might occur if another editor, such as VIM, is used. We're going to investigate this further.

We've filed a ticket to track this as a bug/known issue and look into a fix in an upcoming version. Thanks for posting your notes and the workaround!

[ChrisBell04]

Per support, this bug is SPL-131250, and was resolved as of 6.5.2. It specifically only broke simple xml dashboards which had TAB characters.

[simpkins1958]

[rjthibod]

Weird. I too have had some issues with 6.5 SimpleXML, but unrelated to this. I will be on the lookout for anything similar and will report to the Splunk team.

[rjthibod]

I have not seen this issue and I use tabs a lot. What browser are you using to access the dashboards? Are your SimpleXML files in UTF-8 / ASCII format?

[simpkins1958]

Seeing the issue in latest versions of Chrome and IE. XML files are ASCII format.

[rjthibod]

Also, when you click Edit -> Source, does Splunk show any Validation errors or warnings XML? This is a new feature in 6.5 that has become very handy.

[simpkins1958]

Nope no validation errors.

All works when I change tabs to spaces.

[rjthibod]

what do you see when you look at the job inspector? does it look like the job inspector show the searches in what looks like a reasonably accurate translation for the litsearch field?

[simpkins1958]

See the screen shot I just attached. Job inspector is reporting 40K+ events.