Dashboards & Visualizations
Highlighted

Why is my dashboard reporting error "Node search is not allowed here"?

Path Finder

When I tried Global Search, the dashboard shows warning "Node is not allowed here".
What's wrong with it?

alt text

xml of the dashboard is the following.

<dashboard>
  <label>LABEL TITLE</label>
  <search id="baseSearch">
    <qurey>SEARCH PROCESS LANGUAGE</qurey>
    <earliest>0</earliest>
    <sampleRatio>1</sampleRatio>
  </search>
  <row>
    <panel>
      <title>PANEL TITLE</title>
      <chart>
        <search base="baseSearch">
          <query>POST PROCESS SPL</query>
        </search>
Highlighted

Re: Why is my dashboard reporting error "Node search is not allowed here"?

Community Manager
Community Manager

Hi @diavolo

I'm not sure if this is the cause of your issue since I haven't worked with XML before, but you have typos in the tags on line 4. You spelled "query" as "qurey"

View solution in original post

Highlighted

Re: Why is my dashboard reporting error "Node search is not allowed here"?

Path Finder

After I fixed the typo, the warning has cleared. I wonder the warning message makes no sense against such error...
Thank you!

Highlighted

Re: Why is my dashboard reporting error "Node search is not allowed here"?

Community Manager
Community Manager

No problem! Yeah, that error is not very clear ;0

Oh by the way, thanks for awarding me points 🙂 Just so you know for the future, if you want to give users karma points on Splunk Answers without losing any of your own points, you can just upvote their answers by clicking the up arrow on the left side.

Have a good weekend!

0 Karma
Highlighted

Re: Why is my dashboard reporting error "Node search is not allowed here"?

Splunk Employee
Splunk Employee

This error can also occur if there's a tag without a inside of it.

0 Karma
Highlighted

Re: Why is my dashboard reporting error "Node search is not allowed here"?

Explorer

Can you please expand on that? I am also having this issue, but it's not due to a misspelling, that I can see.

The error is on the following line:

<search index="windows" Account_Name="$Locked_Out_Account_Name$" EventCode="4624">

If I change the <search index= to <search ref= than it works fine. However, I want to perform a direct search here because I want to reference the previously created variable $Locked_Out_Account_Name$. Perhaps there's a way to push the variable in a referenced report and search with it there?

Here's the full code:

<form refresh="60">
  <label>Account PC (Test 11.21) Dashboard</label>
  <description>Blah.</description>
  <fieldset submitButton="false">
    <input type="dropdown" token="Locked_Out_Account_Name" searchWhenChanged="true" depends="$justHideMe$">
      <label>Locked_Out_Account_Name</label>
      <search ref="Account PC (Test 11.21) Report">
        <earliest>-1h</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>Locked_Out_Account_Name</fieldForLabel>
      <fieldForValue>Locked_Out_Account_Name</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>
        <font size="5">
         <body1>Last Refresh Time</body1>
         <body2>$time$</body2>
         <body3>$Locked_Out_Account_Name$</body3>
        </font>
        <style>
            table thead tr th, td{
           font-size:175% !important;
          }
        </style>
      </html>
      <table>
        <title>Account PC (Test 11.21) Report</title>
        <search ref="Account PC (Test 11.21) Report">
          <done>
            <eval token="time">strftime(now(),"%m/%d/%Y %H:%M:%S")</eval>
          </done>
          <earliest>-1h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma