Dashboards & Visualizations

View not working after upgrading from 5.0.4 to 8.0.3

davidharter
New Member

We recently upgraded from 5.0.4 to 8.0.3 ... and one of the remaining issues from that upgrade are a couple of views that are no longer functioning.  The message is:

"Looks like this view is using Advanced XML, which has been removed from Splunk Enterprise."

I have very little HTML experience and even less when it's combined with Splunk.  Can anyone help me to identify the Advanced XML that is referenced in the message?  Here is my view source.

<view autoCancelInterval="90" isSticky="False" isVisible="true" onunloadCancelJobs="true" template="dashboard.html">
<label>PROD</label>
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="AccountBar" layoutPanel="appHeader" />
<module name="AppBar" layoutPanel="appHeader" />
<module name="Message" layoutPanel="messaging">
<param name="filter">*</param>
<param name="maxSize">2</param>
<param name="clearOnJobDispatch">False</param>
</module>

<module name="TimeRangePicker" layoutPanel="panel_row1_col1" autoRun="True">
<module name="SideviewUtils" layoutPanel="appHeader" />
<module name="HTML">
<param name="html"><![CDATA[Instructions: Click on the javathreadid field to search for the corresponding SelectSite apps_log events]]></param>
</module>
<param name="searchWhenChanged">True</param>
<param name="selected">Last 30 minutes</param>
<module name="Search" layoutPanel="panel_row2_col1" autoRun="True">
<param name="search"><![CDATA[index=db2 sourcetype=lockevents participant_no=1 |
rex field=_raw "stmt_text=(?<rqstr_sql>.*)" |
rex field=_raw "event_timestamp=(?<lock_ts>.*)" |
eval rqstr_appserver=case(
hostname="XX.XXX.XXX.45", "serverA.mycompany.com",
hostname="XX.XXX.XXX.43", "serverB.mycompany.com",
hostname="XX.XXX.XXX.23", "serverC.mycompany.com",
hostname="XX.XXX.XXX.41", "serverD.mycompany.com",
hostname="XX.XXX.XXX.46", "serverE.mycompany.com",
hostname="XX.XXX.XXX.24", "serverF.mycompany.com"
) |
rename javathreadid as rqstr_javathreadid, application_handle as rqstr_apphandle |
join type=inner event_id
[
search index=db2 sourcetype=lockevents participant_no=2 |
rex field=_raw "stmt_text=(?<owner_sql>.*)" |
rename javathreadid as owner_javathreadid, application_handle as owner_apphandle |
eval owner_appserver=case(
hostname="XX.XXX.XXX.45", "server.mycompany.com",
hostname="XX.XXX.XXX.43", "server.mycompany.com",
hostname="XX.XXX.XXX.23", "server.mycompany.com",
hostname="XX.XXX.XXX.41", "server.mycompany.com",
hostname="XX.XXX.XXX.46", "serverE.mycompany.com",
hostname="XX.XXX.XXX.24", "serverF.mycompany.com"
) |
fields event_id, owner_sql, owner_javathreadid, owner_apphandle, owner_appserver
] |
fillnull value="None Available" |
dedup lock_ts, host, event_id, event_type, rqstr_javathreadid, owner_javathreadid, rqstr_apphandle, owner_apphandle, tablename, rqstr_appserver, owner_appserver |
table lock_ts, host, event_id, event_type, rqstr_javathreadid, owner_javathreadid, rqstr_apphandle, owner_apphandle, tablename, rqstr_appserver, owner_appserver | sort -lock_ts, -event_id +participant_no]]></param>
<module name="Pager">
<module name="SimpleResultsTable" >
<param name="drilldown">row</param>


<module name="Search" layoutPanel="panel_row3_col1">
<param name="search"><![CDATA[(index=db2 host="$click.fields.host$") OR (index=db2uit host="$click.fields.host$") event_id=$click.fields.event_id$ application_handle=$click.fields.rqstr_apphandle$ | rex field=_raw "stmt_text=(?<sql>.*)" | rex field=_raw "event_timestamp=(?<lock_ts>.*)" | rex field=_raw "stmt_first_use_time=(?<stmt_first_use_ts>.*)" | rex field=_raw "stmt_last_use_time=(?<stmt_last_use_ts>.*)" | table activity_id, stmt_first_use_ts, stmt_last_use_ts, sql | sort -activity_id ]]></param>
<module name="HTML">
<param name="html"><![CDATA[<h3>Requester SQL Statement Search:</h3><b>$search$</b>]]></param>
</module>
<module name="SimpleResultsTable"></module>
</module>

<module name="Search" layoutPanel="panel_row3_col2">
<param name="search"><![CDATA[(index=db2 host="$click.fields.host$") OR (index=db2uit host="$click.fields.host$") event_id=$click.fields.event_id$ application_handle=$click.fields.owner_apphandle$ | rex field=_raw "stmt_text=(?<sql>.*)" | rex field=_raw "event_timestamp=(?<lock_ts>.*)" | rex field=_raw "stmt_first_use_time=(?<stmt_first_use_ts>.*)" | rex field=_raw "stmt_last_use_time=(?<stmt_last_use_ts>.*)" | table activity_id, stmt_first_use_ts, stmt_last_use_ts, sql | sort -activity_id ]]></param>
<module name="HTML">
<param name="html"><![CDATA[<h3>Owner SQL Statement Search:</h3><b>$search$</b>]]></param>
</module>
<module name="SimpleResultsTable"></module>
</module>




<module name="Search" layoutPanel="panel_row4_col1">
<param name="search"><![CDATA[(index=ss host="$click.fields.rqstr_appserver$") OR (index=ssuit host="$click.fields.rqstr_appserver$") $click.fields.rqstr_javathreadid$ ]]></param>
<module name="HTML">
<param name="html"><![CDATA[<h3>Requester Search:</h3><b>$search$</b>]]></param>
</module>
<module name="SoftWrap">
<module name="RowNumbers">
<module name="MaxLines">
<param name="options">
<list>
<param name="text">5</param>
<param name="selected">True</param>
<param name="value">5</param>
</list>
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="value">50</param>
</list>
<list>
<param name="text">100</param>
<param name="value">100</param>
</list>
<list>
<param name="text">200</param>
<param name="value">200</param>
</list>
<list>
<param name="text">All</param>
<param name="value">0</param>
</list>
</param>
<module name="Segmentation">
<param name="options">
<list>
<param name="text">inner</param>
<param name="selected">True</param>
<param name="value">inner</param>
</list>
<list>
<param name="text">outer</param>
<param name="value">outer</param>
</list>
<list>
<param name="text">full</param>
<param name="value">full</param>
</list>
<list>
<param name="text">raw</param>
<param name="value">raw</param>
</list>
</param>
<module name="Events">
<param name="allowTermClicks">False</param>
<param name="fields">series source kb eps</param>
<param name="resizeMode">fixed</param>
<param name="height">300px</param>
</module>
</module>
</module>
</module>
</module>
</module>
<module name="Search" layoutPanel="panel_row4_col2">
<param name="search"><![CDATA[(index=ss host="$click.fields.owner_appserver$") OR (index=ssuit host="$click.fields.owner_appserver$") $click.fields.owner_javathreadid$ ]]></param>
<module name="HTML">
<param name="html"><![CDATA[<h3>Owner Search:</h3><b>$search$</b>]]></param>
</module>
<module name="SoftWrap">
<module name="RowNumbers">
<module name="MaxLines">
<param name="options">
<list>
<param name="text">5</param>
<param name="selected">True</param>
<param name="value">5</param>
</list>
<list>
<param name="text">10</param>
<param name="value">10</param>
</list>
<list>
<param name="text">20</param>
<param name="value">20</param>
</list>
<list>
<param name="text">50</param>
<param name="value">50</param>
</list>
<list>
<param name="text">100</param>
<param name="value">100</param>
</list>
<list>
<param name="text">200</param>
<param name="value">200</param>
</list>
<list>
<param name="text">All</param>
<param name="value">0</param>
</list>
</param>
<module name="Segmentation">
<param name="options">
<list>
<param name="text">inner</param>
<param name="selected">True</param>
<param name="value">inner</param>
</list>
<list>
<param name="text">outer</param>
<param name="value">outer</param>
</list>
<list>
<param name="text">full</param>
<param name="value">full</param>
</list>
<list>
<param name="text">raw</param>
<param name="value">raw</param>
</list>
</param>
<module name="Events">
<param name="allowTermClicks">False</param>
<param name="fields">series source kb eps</param>
<param name="resizeMode">fixed</param>
<param name="height">300px</param>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</module>
</view>

 

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @davidharter ,

your dashboard is done with Advanced XML that is deprecated from some Splunk versions and now out of Splunk 8.

This means that you have to rebuild your dashboard.

If it's a dashboard in an App from Splunkbase, you have to find the new version of this App.

If it's a custom App, you have to do it againg, using the same searches in Simple XML.

 

Only one question: before update from 5.x to 8.0 did you used the Splunk Platform Upgrade Readiness App?

it's very useful to understand if there's something in your installation to upgrade.

Then you should follow an upograding path https://docs.splunk.com/Documentation/Splunk/8.0.4/Installation/HowtoupgradeSplunk

 

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...