Dashboards & Visualizations

When making a copy of a dashboard some searches and comments are pushed to the top of the form.

aoleske
Path Finder

I am copying my dashboard to a new dashboard as I add functionality so I don't destroy the original dashboard. I have discovered that the comments (even though they are within the label as one of the answers here specified), and some of the searches are being pushed to the top of the new dashboard form. What would cause this, and is there a way to stop this from occurring? It is getting wearisome constantly having to rebuild my new dashboards. I will attach an example. All the searches at the top do not belong at the top of the form.

Velocity Dashboard4

<query>host=$host_tokenG$ index=perfmon (sourcetype="perfmon:Physicaldisk") counter="Avg. Disk sec/Read" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeDisk1.earliest$</earliest>
<latest>$PageTimeDisk1.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenH$ index=perfmon (sourcetype="perfmon:Physicaldisk") counter="Avg. Disk sec/Write" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeDisk3.earliest$</earliest>
<latest>$PageTimeDisk3.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenF$ index=perfmon (sourcetype="perfmon:Physicaldisk")  counter="% Idle Time" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeDisk2.earliest$</earliest>
<latest>$PageTimeDisk2.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenG$ index=perfmon (sourcetype="perfmon:Physicaldisk") counter="Avg. Disk sec/Read" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeDisk1.earliest$</earliest>
<latest>$PageTimeDisk1.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenH$ index=perfmon (sourcetype="perfmon:Physicaldisk") counter="Avg. Disk sec/Write" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeDisk3.earliest$</earliest>
<latest>$PageTimeDisk3.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenA$ index=perfmon sourcetype="perfmon:cpu" counter="% processor Time" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeErrType.earliest$</earliest>
<latest>$PageTimeErrType.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenB$ index=perfmon sourcetype="perfmon:cpu" counter="% processor Time" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeErrType.earliest$</earliest>
<latest>$PageTimeErrType.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenC$ index=perfmon sourcetype="perfmon:cpu" counter="% Interupt Time" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeErrType.earliest$</earliest>
<latest>$PageTimeErrType.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>


<query>host=$host_tokenD$ index=perfmon sourcetype="perfmon:cpu" counter="Processor Queue Length" | where instance!="_Total"  | stats count by instance </query>
<earliest>$PageTimeErrType.earliest$</earliest>
<latest>$PageTimeErrType.latest$</latest>
<done>
  <set token="instance">$instance$</set>
</done>
0 Karma
1 Solution

elliotproebstel
Champion

What method are you using for copying a dashboard? When I copy a dashboard, I usually use "clone" from the UI. I have also copied a dashboard by viewing the dashboard Source by clicking Edit > Source from the dashboard itself. Are you taking one of these approaches, or something totally different?

View solution in original post

elliotproebstel
Champion

What method are you using for copying a dashboard? When I copy a dashboard, I usually use "clone" from the UI. I have also copied a dashboard by viewing the dashboard Source by clicking Edit > Source from the dashboard itself. Are you taking one of these approaches, or something totally different?

aoleske
Path Finder

Thank Elliot! That did the trick!

0 Karma

elliotproebstel
Champion

Excellent! Glad to help.

0 Karma

aoleske
Path Finder

I am doing a "save As" to a new name. The comments issue is a known bug that came up in 6.2. Based on Elliot's response I went and found the clone option under Edit in the Dashboard main screen. I will give that a try! Thank you for the feedback!

0 Karma

elliotproebstel
Champion

Great! I'll convert this to an answer. If it works for you, you can accept it. If not, let me know what issues you encounter, and we'll keep trying.

0 Karma

DalJeanis
Legend

Correct, both of those have always resulted in no change to the dashboard for me, other than changes to the name.

0 Karma

aoleske
Path Finder

One other observation when copying dashboards - all the formatting gets stripped out as well.

0 Karma

aoleske
Path Finder

In the description I mentioned I put the comment in the label. I meant within the panel, sorry. I found that answer at https://answers.splunk.com/answers/371225/how-to-add-an-xml-comment-to-the-beginning-of-our.html. Unfortunately, it does not appear to work when copying one dashboard to another.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...