Reporting
Highlighted

Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Explorer

Hi,

After upgrading our SHC to 6.5 from 6,4.1 just recently, we found that the "Pivot" tab you find in all apps (at least pre 6.5) is broken.

Howering over the "Pivot" tab is shows /en-US/app/appname/data_models
When clicking the "Pivot" tab, it first tries to load /en-US/app/appname/pivot
...but then redirects /en-US/app/appname/datasets which gives me a 404.

After creating a new app in 6.5, I could see the tab is renamed to "Datasets" and the link is indeed to /en-US/app/appname/datasets.

Shouldn't Splunk manage these things between upgrades?

Best regards,
Victor

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

I pinged the engineering team on this question.

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

Victor,

I'm sorry you're running into this.

I set up this redirect in order to make sure that system migrations worked. Unfortunately, it looks like it didn't work for you.

Generally: The datasets page lives in the search app and should have system-wide read permissions set via default.meta. Thus, it should be accessible via any app context in splunk. That is, /en-US/app/appname/datasets, should work for any appname. This is the same way that the search page, the pivot page, and all other standard pages are set up.

I'm very curious as to why you don't seem to be able to access this from apps that you made previous to the 6.5 upgrade. This would be the first thing that I would try investigating. Can you access the "dataset" (no s) page from the same apps? How about the older pages that have the same system-wide access, like jobmanager and datemodel_editor?

I will do my best to help you out here, but, for the most in-depth investigation, I'd recommend filing an issue with our support team.

Again, I'm sorry this isn't working for you, and I hope we can get to the bottom of it quickly,
Andrew

Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Explorer

Hi,

And thanks for the quick reply.
I figured as much out by looking where the dataset view were located via the gui, as I couldn't find it in the apps giving me trouble. Guess the upgrade didnt affect the sesrch app for some reason. Didnt have time to try it though as I found some custom knowledge object that Ill have to migrate before updating the SHC search app. Will get back on it tomorrow (now its SplunkLive in Stockholm!)

Best regards,
Victor

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

Victor,

Hope SplunkLive went well. I'll be out of the office for a scheduled medical procedure for a while starting Friday. If you need further help at that point, please reach out to the support team.

Andrew

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Explorer

Hi again,

Just a quick update on this as we found a solution:
We found that although we did deploy a new search app with our SH deployer, that didnt fix the /opt/splunk/etc/apps/search/default/data/ui/views/* . Once we uploaded the files directly to a SH and restarted it, the Dataset link (and others we found to be broken) started to work again.

Best regards,
Victor

View solution in original post

Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

Victor, I'm glad that you got it working. I'll make sure that this information gets to our engineering teams so that we can hopefully identify root cause and make sure this doesn't happen again.

Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

Hi Victor,

So you first upgraded all the SHC instances from 6.4 to 6.5 and found the Pivot tab issue, then you tried deploying a new search app (6.5) with SHC deployer (and issue still occurred), and finally you uploaded the new search app files directly to the SH and issue was resolved, right?

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Explorer

Hi,

Yes, that's how I understand it although I didn't do all steps personally during the process. I don't know why it was needed but perhaps previous changes/additions in our search app was hindering it to be update properly during upgrade.

Br,
Victor

0 Karma
Highlighted

Re: Splunk 6.5.0: Why is the default app tab "Pivot" broken in all apps after upgrade?

Splunk Employee
Splunk Employee

The search app was failed to be upgraded and caused the 404 error. You can check /var/log/splunk/migration.log and contact splunk support. You may also send that to me for investigation if you are fine with it.

0 Karma