Reporting

Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

victorrosberg
Explorer

Hi,

After upgrading our SHC to 6.5 from 6,4.1 just recently, we found that the "Pivot" tab you find in all apps (at least pre 6.5) is broken.

Howering over the "Pivot" tab is shows /en-US/app/appname/data_models
When clicking the "Pivot" tab, it first tries to load /en-US/app/appname/pivot
...but then redirects /en-US/app/appname/datasets which gives me a 404.

After creating a new app in 6.5, I could see the tab is renamed to "Datasets" and the link is indeed to /en-US/app/appname/datasets.

Shouldn't Splunk manage these things between upgrades?

Best regards,
Victor

0 Karma
1 Solution

victorrosberg
Explorer

Hi again,

Just a quick update on this as we found a solution:
We found that although we did deploy a new search app with our SH deployer, that didnt fix the /opt/splunk/etc/apps/search/default/data/ui/views/* . Once we uploaded the files directly to a SH and restarted it, the Dataset link (and others we found to be broken) started to work again.

Best regards,
Victor

View solution in original post

cdeflon
Engager

The installation is missing the views needed to generate the missing pages.

Check that /opt/splunk/etc/apps/search/default/data/ui/views has all the needed xml files.,The installation is missing views under /opt/splunk/etc/apps/search/default/data/ui/views....

0 Karma

victorrosberg
Explorer

Hi again,

Just a quick update on this as we found a solution:
We found that although we did deploy a new search app with our SH deployer, that didnt fix the /opt/splunk/etc/apps/search/default/data/ui/views/* . Once we uploaded the files directly to a SH and restarted it, the Dataset link (and others we found to be broken) started to work again.

Best regards,
Victor

jzhang_splunk
Splunk Employee
Splunk Employee

Hi Victor,

So you first upgraded all the SHC instances from 6.4 to 6.5 and found the Pivot tab issue, then you tried deploying a new search app (6.5) with SHC deployer (and issue still occurred), and finally you uploaded the new search app files directly to the SH and issue was resolved, right?

0 Karma

victorrosberg
Explorer

Hi,

Yes, that's how I understand it although I didn't do all steps personally during the process. I don't know why it was needed but perhaps previous changes/additions in our search app was hindering it to be update properly during upgrade.

Br,
Victor

0 Karma

ali_splunk
Splunk Employee
Splunk Employee

Hi Victor,
Do you manage the search apps via deployer in your environment?
Just wondering if this is the case?
- you upgrade splunk on search heads from 6.4 to 6.5
- then you by chance invoke "apply shcluster-bundle" on the deployer, and the old version search app on deployer covers the upgraded one

0 Karma

jzhang_splunk
Splunk Employee
Splunk Employee

The search app was failed to be upgraded and caused the 404 error. You can check /var/log/splunk/migration.log and contact splunk support. You may also send that to me for investigation if you are fine with it.

0 Karma

arobbins_splunk
Splunk Employee
Splunk Employee

Victor, I'm glad that you got it working. I'll make sure that this information gets to our engineering teams so that we can hopefully identify root cause and make sure this doesn't happen again.

victorrosberg
Explorer

Hi,

And thanks for the quick reply.
I figured as much out by looking where the dataset view were located via the gui, as I couldn't find it in the apps giving me trouble. Guess the upgrade didnt affect the sesrch app for some reason. Didnt have time to try it though as I found some custom knowledge object that Ill have to migrate before updating the SHC search app. Will get back on it tomorrow (now its SplunkLive in Stockholm!)

Best regards,
Victor

0 Karma

arobbins_splunk
Splunk Employee
Splunk Employee

Victor,

Hope SplunkLive went well. I'll be out of the office for a scheduled medical procedure for a while starting Friday. If you need further help at that point, please reach out to the support team.

Andrew

0 Karma

ChrisG
Splunk Employee
Splunk Employee

I pinged the engineering team on this question.

0 Karma

arobbins_splunk
Splunk Employee
Splunk Employee

Victor,

I'm sorry you're running into this.

I set up this redirect in order to make sure that system migrations worked. Unfortunately, it looks like it didn't work for you.

Generally: The datasets page lives in the search app and should have system-wide read permissions set via default.meta. Thus, it should be accessible via any app context in splunk. That is, /en-US/app/appname/datasets, should work for any appname. This is the same way that the search page, the pivot page, and all other standard pages are set up.

I'm very curious as to why you don't seem to be able to access this from apps that you made previous to the 6.5 upgrade. This would be the first thing that I would try investigating. Can you access the "dataset" (no s) page from the same apps? How about the older pages that have the same system-wide access, like job_manager and date_model_editor?

I will do my best to help you out here, but, for the most in-depth investigation, I'd recommend filing an issue with our support team.

Again, I'm sorry this isn't working for you, and I hope we can get to the bottom of it quickly,
Andrew

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...