Dashboard not loading after Splunk upgrade from 6.5.3 to 7.1.3.

[nawazns5038]

After Upgrading Splunk from 6.5.3 to 7.1.3, some of my dashboards are not loading, they are stuck at Loading phase and not displaying any content.

What could be the reason? I haven't touched the XML of the dashboard. Is there anything related to a javascript of the new version or advanced XML not being loaded in the new version of Splunk ??

I am not sure if the XML is advanced or simple.

[cmerriman · Accepted solution]

that is a lot of deprecated xml. try something like this:

<form>
  <label>Dashboard Performance</label>
  <description></description>
  <fieldset submitButton="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label></label>
      <default>
        <earliest>-7d@h</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>USER_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="*">All</choice>
      <default>*</default>
      <fieldForLabel>label</fieldForLabel>
      <fieldForValue>DASHBOARD_ID</fieldForValue>
      <search>
        <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <search>
          <query>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

you can see that populatingSearch is no longer supported. either is earliest/latestTime the way the inputs are configured has also changed, as far as formatting. if you can apply the differences between this xml and the original to the rest of the broken dashboards in the app, they should all probably start working.

[nawazns5038]

Works very well . Thanks !!

Is there any documentation regarding the deprecated XML in the new version ?

[cmerriman]

here is documentation on some older XML:
http://docs.splunk.com/Documentation/Splunk/6.0/Viz/PanelreferenceforSimplifiedXML

here is documentation on new XML:
http://docs.splunk.com/Documentation/Splunk/latest/Viz/PanelreferenceforSimplifiedXML

i don't think there is actually any document that specifies "Here are the deprecated nodes" or "replace these with these". if there are, @cgales9 could probably chime in, or @lstewart_splunk

[maciep]

have you tried clearing your browser cache?

[nawazns5038]

Yes, I have tried in incognito mode and other browser as well. Anyhow the documentation says the app is not compatible with Splunk 7.1, I want to know the reason behind it or is there a way to make the dashboard working.

[adonio]

which app is that?
are all dashboards from same app?

[nawazns5038]

Splunk App for Salesforce.
Some are loading and some are stuck at the loading phase . Same XML works in 6.5.3
https://splunkbase.splunk.com/app/1931/

[cmerriman]

what dashboards in the app? can you provide a sample of the xml? with the app not being compatible with 7.1, there could be some outdated xml or searches in there.

[nawazns5038]

<form>
  <label>Dashboard Performance</label>
  <description/>
  <fieldset submitButton="false" autoRun="false">
    <input type="time" token="field1" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-7d@h</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
    <input type="multiselect" token="USER_ID" searchWhenChanged="true">
      <label>Username</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="USER_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by Name USER_ID | sort -count | eval label=Name." (".count.")" | eval USER_ID="USER_ID=".USER_ID</populatingSearch>
      <default/>
    </input>
    <input type="multiselect" token="DASHBOARD_ID" searchWhenChanged="true">
      <label>Dashboard Name</label>
      <choice value="">All</choice>
      <populatingSearch fieldForLabel="label" fieldForValue="DASHBOARD_ID">eventtype=sfdc-event-log EVENT_TYPE=Dashboard | stats count by DASHBOARD_NAME DASHBOARD_ID | sort -count | eval label=DASHBOARD_NAME." (".count.")" | eval DASHBOARD_ID="DASHBOARD_ID=".DASHBOARD_ID</populatingSearch>
     <default/>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <title>Dashboard Performance over time</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$|  timechart count | predict count | rename count  AS "Report Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">true</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
        <option name="charting.chart.overlayFields">"Average Run Time (sec)"</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <chart>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ |stats count by Username   | sort  10 -count | fields - total | rename count AS "Dashboard Execution Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="charting.axisLabelsX.majorLabelStyle.overflowMode">ellipsisNone</option>
        <option name="charting.axisLabelsX.majorLabelStyle.rotation">0</option>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.axisX.scale">linear</option>
        <option name="charting.axisY.scale">linear</option>
        <option name="charting.axisY2.enabled">false</option>
        <option name="charting.axisY2.scale">inherit</option>
        <option name="charting.chart">bar</option>
        <option name="charting.chart.nullValueMode">gaps</option>
        <option name="charting.chart.sliceCollapsingThreshold">0.01</option>
        <option name="charting.chart.stackMode">stacked</option>
        <option name="charting.chart.style">shiny</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.layout.splitSeries">0</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisMiddle</option>
        <option name="charting.legend.placement">right</option>
      </chart>
    </panel>
    <panel>
      <table>
        <title>Most Accessed Dashboards By Username</title>
        <searchString>eventtype=sfdc-event-log EVENT_TYPE=Dashboard $USER_ID$ $DASHBOARD_ID$ | stats count by FirstName, LastName, Username| sort 10 - count | rename count AS "Dashboard Run Count"</searchString>
        <earliestTime>$field1.earliest$</earliestTime>
        <latestTime>$field1.latest$</latestTime>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</form>

That is the one of the dashboards that is not working. Any reason for not being compatible.