Dashboards & Visualizations
Highlighted

Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor

Lots of my dashboard panels in simple XML are no longer working since upgrading to 6.5. Getting "No results found." But when I open up in search the SPL work fine with lots of results.

Issue appears to be tab characters in my SPL.

    <search base="baseSearch_wwan_connectfailure">
      <query>stats count as Failures by car 
           | sort-Failures 
           | rename car as "Carrier"
      </query>

If I replace the tab characters with spaces all is working again.

Anyone else seeing this issue?

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Champion

I have not seen this issue and I use tabs a lot. What browser are you using to access the dashboards? Are your SimpleXML files in UTF-8 / ASCII format?

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor

Seeing the issue in latest versions of Chrome and IE. XML files are ASCII format.

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Champion

what do you see when you look at the job inspector? does it look like the job inspector show the searches in what looks like a reasonably accurate translation for the litsearch field?

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor

See the screen shot I just attached. Job inspector is reporting 40K+ events.

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Champion

Also, when you click Edit -> Source, does Splunk show any Validation errors or warnings XML? This is a new feature in 6.5 that has become very handy.

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor

Nope no validation errors.

All works when I change tabs to spaces.

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor
0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Champion

Weird. I too have had some issues with 6.5 SimpleXML, but unrelated to this. I will be on the lookout for anything similar and will report to the Splunk team.

0 Karma
Highlighted

Re: Since upgrading to 6.5 many dashboard panels NOT working - TAB character issue in the SPL?

Contributor

Replacing all tab characters with spaces in my XML files fixed the issue.