- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Installation
- :
- Splunk 6 upgrade breaks timepicker in dash amongst...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all,
I just upgraded Splunk to the new version 6.0 on a test server with all our apps on, and it seems that the timepicker isn't working on any of our dashboards. It's just defaulting to "All Time". I tried deleting the timepicker and re-adding from the editor but still no joy. Am I missing something here? All the panels are just standard saved searches (or "reports" as they now seem to be called). I tried making a new dash but still have the same issue.
Also, custom styles are completely gone - for example, Cisco Security Suite tries to load the custom styles, then you see it getting overriden by the default grey theme. This seems to be a result of the CSS changes in the documentation though. Hopefully I can fix that easily. 🙂
Am I missing something here? Has anyone else seen the timepicker issue? The upgrade was coming from 5.0.3.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's a Splunk education video on Creating dashboards for Version 6. At about 5 min 30 into the video it talks about adding the timepicker and the need to convert the searches in each of the panels on the dashboard to be inline searches. Could this be related to your problem?
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's a Splunk education video on Creating dashboards for Version 6. At about 5 min 30 into the video it talks about adding the timepicker and the need to convert the searches in each of the panels on the dashboard to be inline searches. Could this be related to your problem?
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes, thanks! That seems to be the issue with the timepicker.... Cloning all of them to inline and removing the relevant XML has sorted it. I understand what's happening now - the search string is embedded in the dashboard rather than just being a reference to a saved search.
Not sure how I feel about this in all honesty. Being able to refer to saved searches means that if you have the same search in different dashboards presented a different way, you only need to change the search in a single location.
Looks like I've got work to do on the test box before exporting my apps out again!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There's some info about CSS and other good pointers for developers in the Changes for Splunk App developers topic in the Installation Manual. Not quite sure what's up with the time picker, though, especially if you added it back from the editor and it's still not working...sorry.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hrm, I reverted the test system anyhow. I'm going to spin up another test system and see if I can replicate this. It's a bit unnerving to say the least. I wonder if the upgrade has done something with the saved searches to stop the time picker from having any effect, I didn't think about that at the time.
Call me a little over-cautious but anything with a .0 version number makes me nervous! 😛
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
