Splunk 6 - converting simple xml to advanced xml with saved search issue

[MattZerfas]

I am running Splunk 6 and when I try to convert an example dashboard from simple xml to advanced xml I can no longer get it to show my saved searches.

Here is what my simple xml looks like.

<dashboard>
  <label>Test</label>
  <description/>
  <row>
    <chart>
      <searchName>Count of Purchases by Title Chart</searchName>
    </chart>
  </row>
</dashboard>

I add the showsource=advanced to the existing url.( .../?showsource=advanced) then scroll down and copy the xml data in the box at the bottom.

Here is the advanced xml data that I copied.

<view autoCancelInterval="90" isVisible="true" objectMode="SimpleDashboard" onunloadCancelJobs="true" refresh="-1" template="dashboard.html">
  <label>Test</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="maxSize">1</param>
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
  </module>
  <module name="DashboardTitleBar" layoutPanel="viewHeader"/>
  <module name="Message" layoutPanel="navigationHeader">
    <param name="level">warn</param>
    <param name="maxSize">1</param>
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
  </module>
  <module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True">
    <param name="savedSearch">Count of Purchases by Title Chart</param>
    <module name="ViewstateAdapter">
      <param name="savedSearch">Count of Purchases by Title Chart</param>
      <param name="suppressionList"/>
      <module name="HiddenFieldPicker">
        <param name="strictMode">True</param>
        <module name="JobProgressIndicator">
          <module name="EnablePreview">
            <param name="display">False</param>
            <param name="enable">True</param>
            <module name="HiddenChartFormatter">
              <module name="JSChart">
                <param name="width">100%</param>
                <module name="Gimp"/>
                <module name="ConvertToDrilldownSearch">
                  <module name="ViewRedirector">
                    <param name="viewTarget">flashtimeline</param>
                  </module>
                </module>
              </module>
              <module name="ViewRedirectorLink">
                <param name="viewTarget">flashtimeline</param>
              </module>
            </module>
          </module>
        </module>
      </module>
    </module>
  </module>
</view>

I then go back to the dashboard to edit the xml(still simple at this point). Delete out all existing info and paste in the advanced xml data that I just copied previously. Save it and then I get the following error. Why? This method of converting simple to advanced xml has always works for me in the past.

Configuration error - we were not able to find a saved search called 'Count of Purchases by Title Chart'.

[gkanapathy · Accepted solution]

Just to be quite clear, Splunk 6, unlike versions 4.x and 5.x, does not run Simple XML pages as Advanced XML. Instead they are converted to HTML and run that way. The conversion you see is simply a legacy feature. The preferred ways to customize Simple XML are: first, to use extensions by including JavaScript and CSS; second, if that is insufficient, to convert to HTML; third, if those are insufficient, to use the Splunk Django App Framework; fourth, to write custom interfaces from scratch using the SDKs and REST API. The use of Advanced XML to customize is no longer encouraged.

[MattZerfas]

The code above is exactly as it was when I added "showsource=advanced" to my existing simple xml dashboard. So that is what splunk generated.

I tried removing the 2nd one under the ViewstateAdapter but that made no difference. Any other suggestions?

[ShaneNewman]

Why are you calling the saved search twice in the same module set? You should only need to call it once, above the ViewstateAdapter module.