Splunk ITSI

Why have glass table contents disappeared after upgrading Splunk IT Service Intelligence (ITSI) to 2.4.0?

thilleso
Path Finder

Hi, just upgraded to ITSI 2.4.0 (from 2.2.0) and the content of all the saved glass tables have disappeared. The glass tables are there, but none of the saved elements (background image, KPIs, etc) are there.
Do anyone know where ITSI saves the elements so I can do a restore of them?

0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@thilleso - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post. If no, please leave a comment with more feedback. Thanks.

0 Karma

sroback_splunk
Splunk Employee
Splunk Employee

If you suspect it is a KV store permissions issue, you might have a look at this doc which explains how to set permission to KV store collections: http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/Configureusersandroles#Set_permissions_to_...

kfsplunk
Observer

Please verify that you have your Splunk core at level 6.4 or above. I just tested an upgrade of ITSI from 2.2.2 to 2.4.0 on a 6.3 Splunk Enterprise level and also noticed that all Glass Tables were empty.
Restoring a saved version of the KV store brought back my Glass Tables.
See http://docs.splunk.com/Documentation/ITSI/2.4.0/Configure/BackupandRestoreITSIconfig

0 Karma

tfletcher_splun
Splunk Employee
Splunk Employee

Prior to ITSI 2.3 they were stored along with the definition of the glass table. In the data migration step for your update they should have been moved to a new storage location to improve the load time of glass tables. In order to troubleshoot the issue you probably want to look for either 404 or 403 status codes in the js console for your web browser. Hopefully it is just a matter of some special permissions on the new storage location and the REST endpoint to access them. If you see those messages on the browser then you want to try and find out if the collection permissions is the issue. Your images should be in this KV Store collection, SA-ITOA_filesif you have content there when an admin looks it is likely a permissions issue. If you do not have content there when an admin looks it is likely an upgrade issue. If you are unable to resolve the permission issue or if it looks like it is an upgrade issue, you should open a case with Support and we can get you straightened out.

thilleso
Path Finder

Don't get any 403 or 404 status codes in the console, sadly.

I made a new glass table with a background, which is functioning as it should. But what's more frustrating is that I can't seem to find that image on the server either. The console shows the image is being loaded from endpoint https://<localhost>/en-US/splunkd/__raw/services/SA-ITOA/v1/files/57f3efac107df5db97351e41, but I can't find the endpoint on the server.

When loading a glass table with missing elements I get an error in the console, which does not appear when loading the new glass table made after the update.

Error:  attribute viewBox: Expected number, "NaN NaN 1349 452". glass_table_editor.js:9
redo @ glass_table_editor.js:9
execute @ glass_table_editor.js:9
_loadSavedGlassTable @ glass_table_editor.js:15
(anonymous function) @ glass_table_editor.js:15 

I'm both Splunk admin and have root access to the server (running CentOS 7).

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...