Dashboards & Visualizations

">" and "<" causing An error occurred while fetching data in a dashboard panel using a base search

marlykono
Engager

An error occurred while fetching data when ">" or "<" are used in a dashboard panel using a base search
When trying to open the search inside the panel Error 403 Forbidden occurs
There is no error with "="
There is no error when the entire search is place in the panel
I am using Splunk7.0.1

alt text

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi marlykono,

you need to encode the < as &lt; and > as &gt; in the XML like this:

<query>| stats count AS CNT by index | eval MN=12 | where CNT < MN

or modify the search string using the edit mode and then the magnifier to edit the search.

Hope this helps ...

cheers, Mus

marlykono
Engager

I wish it was that easy, the xml would have never allowed me to save a code with <
The editor used here translated my < to <

0 Karma

MuS
SplunkTrust
SplunkTrust

Okay, I tried it with this run everywhere search :

<dashboard>
  <label>foobar</label>
  <row>
    <panel>
      <table>
        <title>table</title>
        <search id="baseSearch">
          <query>| tstats count WHERE index=_* by index source | stats count by index source</query>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <table>
        <title>table</title>
        <search base="baseSearch">
          <query>| stats count AS CNT by index | eval MN="12" | where CNT &lt; MN</query>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</dashboard>

switched the lesser or greater than in every possible way, placed the base and post-processing search all over the place, and never got any error message like you mentioned in the question.

My suggestion here is to check for any weird copy paste characters in the XML. Other than that I'm out of ideas ¯\_(ツ)_/¯ , beside of course check the job inspector or any Splunk logs for additional information what is causing this ....

cheers, MuS

niketn
Legend

@marlykono, also if you are on Splunk 7.0.1 and editing the dashboard in Simple XML Editor, the editor should highlight the row with spooky character and mention some detail around the error. Can you add that screenshot, if your issue is not resolved yet?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

niketn
Legend

@marlykono, as suggested by @MuS, easy way to do it is Edit the Panel in UI and then apply your search. As you would have noticed search panel does accept < and > characters and need not be escaped.

Only when you are editing in SimpleXML or sometimes in Web Framework (HTML/Splunk JS Code), you might have to escape the character like &lt; and &gt;. Hope the difference is clear!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...