Dashboards & Visualizations

Why does Dashboard Studio grey out "Open in Search" button?

yuanliu
SplunkTrust
SplunkTrust

I have many Dashboard Studio dashboards by now.  Those created earlier function normally.  But starting a few days ago, new dashboard created cannot use "Open in Search" function any more; the magnifying glass icon is greyed out.  "Show Open In Search Button" is checked.  Any insight?  My servers is 9.2.2 and there has been no change on server side.

Screenshot 2024-10-16 at 4.57.54 PM.png

image.png

Labels (1)
0 Karma
1 Solution

sainag_splunk
Splunk Employee
Splunk Employee

I don't think we can change that in the JSON code. Looks like a bug to me. I can check internally and see what I can do.

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Quick summary: After @sainag_splunk identified this as a 9.2 bug, I updated the affected instance to 9.3 and the problem is gone.

sainag_splunk
Splunk Employee
Splunk Employee

Hello @yuanliu . I noticed an issue when I cloned my classic dashboards to Studio. Is this happening with brand new dashboards created in Studio? My 9.2.2 (Cloud) version has been verified to have the same issue when cloning from Classic to Studio. However, there are no issues with the original Studio dashboards.

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@sainag_splunk Working dashboards and problematic dashboards are both created inside Dashboard Studio in 9.2.2 in the same server.  This is why it is so puzzling.  Is there a setting to grey out "Open in Search" that I may accidentally enable?

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

@yuanliu can you try clicking inspect on the magnifying glass and see  if that might help? If thats the case looks like a new bug to me.

<button data-test="open-search-button" type="button" data-disabled="false" data-clickable="true" 

 

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@sainag_splunk I opened inspect for two recently created dashboards, the last one that does not have this problem and the first one that has.  The one that I cannot use the magnifying glass has data-disabled="true" whereas the earlier one has data-disabled="false".

conditiondata-disableddate dashboard created
Unable to Open in Searchtrue2024-10-16
Able to Open in Searchfalse2024-10-09

Date created is the only obvious difference between the two.  Even the construction of the two dashboards are the same.  I saved a search to create a dashboard, and added some inputs.

So, my hope is that there is a code element in JSON that I can tweak to fix this problem.  Just need to know where.

0 Karma

sainag_splunk
Splunk Employee
Splunk Employee

I don't think we can change that in the JSON code. Looks like a bug to me. I can check internally and see what I can do.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

@sainag_splunk is correct.  This has to be a bug in 9.2.  I'm about to upgrade to 9.3, so I rushed a bunch of tests.  The results suggest that it has something to do with search results or with input.

 9.2.29.3.1
Basic search like makeresults, tstats, no inputNo problemNo problem
Some complex searches, with inputsNo problem(Not tested)
Latest dashboard with some other searches, similar inputsCannot Open in Search(N/A)
Code copy of problematic dashboardCannot Open in SearchNo problem
Recreattion of problematic dashboardCannot Open in Search(N/A)

So, the last two rows are really interesting and took quite some time.  I copied the entire JSON from a problematic dashboard to a test instance running 9.3.1 that has similar test data, and saw no problem.  Then, I tried several methods to recreate that problematic dashboard in the 9.2.2 instance.  First, I simply copied JSON to a new test board and saw the same problem.  I thought there might be something wrong with the code.  So, I copied individual searches and inputs, in two different ways.  They all give the same problematic results.

0 Karma

jhaveko
Engager

I am running into this issue as well. Following for more information. 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...