Lots of my dashboard panels in simple XML are no longer working since upgrading to 6.5. Getting "No results found." But when I open up in search the SPL work fine with lots of results.
Issue appears to be tab characters in my SPL.
<search base="baseSearch_wwan_connectfailure"> <query>stats count as Failures by car | sort-Failures | rename car as "Carrier" </query>
If I replace the tab characters with spaces all is working again.
Anyone else seeing this issue?
I have not seen this issue and I use tabs a lot. What browser are you using to access the dashboards? Are your SimpleXML files in UTF-8 / ASCII format?
what do you see when you look at the job inspector? does it look like the job inspector show the searches in what looks like a reasonably accurate translation for the litsearch field?
Also, when you click Edit -> Source, does Splunk show any Validation errors or warnings XML? This is a new feature in 6.5 that has become very handy.
Weird. I too have had some issues with 6.5 SimpleXML, but unrelated to this. I will be on the lookout for anything similar and will report to the Splunk team.