Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

[victorrosberg]

Hi,

After upgrading our SHC to 6.5 from 6,4.1 just recently, we found that the "Pivot" tab you find in all apps (at least pre 6.5) is broken.

Howering over the "Pivot" tab is shows /en-US/app/appname/data_models
When clicking the "Pivot" tab, it first tries to load /en-US/app/appname/pivot
...but then redirects /en-US/app/appname/datasets which gives me a 404.

After creating a new app in 6.5, I could see the tab is renamed to "Datasets" and the link is indeed to /en-US/app/appname/datasets.

Shouldn't Splunk manage these things between upgrades?

Best regards,
Victor

[cdeflon]

The installation is missing the views needed to generate the missing pages.

Check that /opt/splunk/etc/apps/search/default/data/ui/views has all the needed xml files.,The installation is missing views under /opt/splunk/etc/apps/search/default/data/ui/views....

[victorrosberg · Accepted solution]

Hi again,

Just a quick update on this as we found a solution:
We found that although we did deploy a new search app with our SH deployer, that didnt fix the /opt/splunk/etc/apps/search/default/data/ui/views/* . Once we uploaded the files directly to a SH and restarted it, the Dataset link (and others we found to be broken) started to work again.

Best regards,
Victor

[jzhang_splunk]

Hi Victor,

So you first upgraded all the SHC instances from 6.4 to 6.5 and found the Pivot tab issue, then you tried deploying a new search app (6.5) with SHC deployer (and issue still occurred), and finally you uploaded the new search app files directly to the SH and issue was resolved, right?

[victorrosberg]

Hi,

Yes, that's how I understand it although I didn't do all steps personally during the process. I don't know why it was needed but perhaps previous changes/additions in our search app was hindering it to be update properly during upgrade.

Br,
Victor

[ali_splunk]

Hi Victor,
Do you manage the search apps via deployer in your environment?
Just wondering if this is the case?
- you upgrade splunk on search heads from 6.4 to 6.5
- then you by chance invoke "apply shcluster-bundle" on the deployer, and the old version search app on deployer covers the upgraded one

[jzhang_splunk]

The search app was failed to be upgraded and caused the 404 error. You can check /var/log/splunk/migration.log and contact splunk support. You may also send that to me for investigation if you are fine with it.

[arobbins_splunk]

Victor, I'm glad that you got it working. I'll make sure that this information gets to our engineering teams so that we can hopefully identify root cause and make sure this doesn't happen again.

[victorrosberg]

Hi,

And thanks for the quick reply.
I figured as much out by looking where the dataset view were located via the gui, as I couldn't find it in the apps giving me trouble. Guess the upgrade didnt affect the sesrch app for some reason. Didnt have time to try it though as I found some custom knowledge object that Ill have to migrate before updating the SHC search app. Will get back on it tomorrow (now its SplunkLive in Stockholm!)

Best regards,
Victor

[arobbins_splunk]

Victor,

Hope SplunkLive went well. I'll be out of the office for a scheduled medical procedure for a while starting Friday. If you need further help at that point, please reach out to the support team.

Andrew

[ChrisG]

I pinged the engineering team on this question.

[arobbins_splunk]

Victor,

I'm sorry you're running into this.

I set up this redirect in order to make sure that system migrations worked. Unfortunately, it looks like it didn't work for you.

Generally: The datasets page lives in the search app and should have system-wide read permissions set via default.meta. Thus, it should be accessible via any app context in splunk. That is, /en-US/app/appname/datasets, should work for any appname. This is the same way that the search page, the pivot page, and all other standard pages are set up.

I'm very curious as to why you don't seem to be able to access this from apps that you made previous to the 6.5 upgrade. This would be the first thing that I would try investigating. Can you access the "dataset" (no s) page from the same apps? How about the older pages that have the same system-wide access, like job_manager and date_model_editor?

I will do my best to help you out here, but, for the most in-depth investigation, I'd recommend filing an issue with our support team.

Again, I'm sorry this isn't working for you, and I hope we can get to the bottom of it quickly,
Andrew