I am experiencing the exact same issue in our deployment after upgrading from 9.0.5 to 9.1.0.2.  Most of the visualisations fail to load, and "Indexing Rate" and "Concurrent Searches" only show "N/A".  The new "Splunk Assist" banner at the top of the Overview page also fails to load. 

Hi, I've just come acroos this post and your trellised charts are very similar to something I am tryng the achieve. I am new to Splunk and so may be missing something, but I can;t replicate your layout. - is the XML you posted necessary to get the layout you have? This is my search: index=felix_emea sourcetype="Felixapps:prod:log" Action = "Resp_VPMG" | dedup EventIndex | rex field=Message "^<b>(?<Region>.+)<\/b>" | rex "Response Codes:\s(?<responseCode>\d{1,3})" | rex field=Message ":\s(?<errCount>\d{1,4})$" | bin _time span=1h | stats count by _time, Region, responseCode | eval {responseCode}=count | fields - responseCode, region, count This is a sample of my data: Time responseCode Region errCount 21/11/2022 09:46:07 912 VPMG - Wizink PRD-E5 14 21/11/2022 09:16:31 911 Moneta IBS via VPMG 8 21/11/2022 03:02:07 912 Moneta IBS via VPMG 129 21/11/2022 02:46:59 911 Moneta IBS via VPMG 92 20/11/2022 20:31:38 911 Moneta IBS via VPMG 16 20/11/2022 19:31:36 912 Moneta IBS via VPMG 32 20/11/2022 02:26:45 911 Addiko IBS via VPMG 7   and this is the visualisation I'm trying to acheive (this is done in Power BI): Is this achieveable in Splunk? Thanks, Steve  

We are using a query to get results based on previous month and also date range (dd-mm-yy).. But in our query, we used to get results only for previous month, not for the date range(its not accepting the double quotes ("") for the number, when I remove "". its not accepting the string :(.. query we used for reference...   Isnum is not working with "", if I remove "". string is not working..pls suggest me the solution, tried different ways but nothing is working.. | eval lnum=if(match("1690848000","^[@a-zA-Z]+"),"str","num"), enum=if(match("1688169600","[a-zA-Z]"),"str","num") | eval latest=case(isnum(1690848000),(1690848000-60),"1690848000"="now",now(),"1690848000"="",now(),lnum!="str","1690848000",1=1,relative_time(now(), "1690848000")) | eval earliest=case(isnum(1688169600),(1688169600-60),"1688169600"="0","0",enum!="str","1688169600",1=1,relative_time(now(), "1688169600"))     I want to have same data for previous month and also date range filters...This is question..

Hi Vatsal, I lost access to this account, so havent been able to reply until now. This is the query you suggested I try: index=felix_emea sourcetype="Felixapps:prod:log" Action = "Resp_VPMG" | dedup EventIndex | rex field=Message "^<b>(?<Region>.+)<\/b>" | rex "Response Codes:\s(?<responseCode>\d{1,3})" | rex field=Message ":\s(?<errCount>\d{1,4})$" | bin _time span=1h | stats count by _time, Region responseCode | eval {Region}=count | fields - Region, count   I'm not sure what the visualisation is showing me exactly : I can activate a trellis display buy region, but the bars on each graph )when I activate the legend) are labelled as 'responseCode' and the region. All bars are showing as just under 1,000: Again, the Power BI display I am trying to replicate is this: With a timechart of the count of response codes by region, trellised by responsecode.  Here is the sample data for the Power BI report: Time Action responseCode Region errCount 21/11/2022 09:46:07 Resp_VPMG 912 VPMG - Wizink PRD-E5 14 21/11/2022 09:16:31 Resp_VPMG 911 Moneta IBS via VPMG 8 21/11/2022 03:02:07 Resp_VPMG 911 Moneta IBS via VPMG 129 21/11/2022 02:46:59 Resp_VPMG 911 Moneta IBS via VPMG 92 20/11/2022 20:31:38 Resp_VPMG 911 Moneta IBS via VPMG 16 20/11/2022 19:31:36 Resp_VPMG 911 Moneta IBS via VPMG 32 20/11/2022 02:26:45 Resp_VPMG 911 Addiko IBS via VPMG 7   ('Action' is not used).      

Free license or not free license, Splunk UI should not display cryptic error message.  I consider this a usability bug because the license type can easily be handled with clearer message. You can disable Splunk Assist.  But that will not solve this problem. To disable the application, go to $SPLUNK_HOME/etc/apps/splunk_assist.  Create a directory local/, then create a file app.conf to override allow_disable=true in [install] stanza, like this:   cd $SPLUNK_HOME/etc/apps/splunk_assist mkdir local cat <<EOM >local/app.conf [install] allows_disable = false EOM       After restarting Splunk, you can then disable splunk_assist.  But the error will persist even when Splunk Assist is disabled.  BTW, if you launch splunk_assist directly, you will be able to see the error message Unable to obtain template "beam:/templates/start.html": ... TopLevelLookupException(_("Splunk has failed to locate the template for uri '%s'." % uri)) TopLevelLookupException: Splunk has failed to locate the template for uri 'beam:/templates/start.html'. The problem is that a 9.1 upgrade enables a feature called enable_home_vnext.  It is a fine feature (with tons of marketing plugs) except for this bug: Splunk should detect the free license and handle the error without showing a cryptic error message. (It can show, for example, "this feature is unavailable for the installed license" like it does with a bunch of other features.) Workaround The only workaround I have discovered so far is to disable enable_home_vnext in [feature:page_migration] stanza from web-features.conf.  ([feature:page_migration] is introduced in 9.x but is in web.conf. web-features.conf is introduced in 9.1.1; a skeleton local/web-features.conf is created by installer but the stanza is not in it.)     cd $SPLUNK_HOME/etc/system/local cat <<EOM>>web-features.conf [feature:page_migration] enable_home_vnext = false EOM     After this, you will see your previous launcher home page instead of the migration page. (You may need to to restart splunkd.  I had at least one instance for which I did not perform restart after editing.)  I hope Splunk will not take the legacy launch page away before fixing the bug in the new page. What changed? The new index _configtracker added in 9.x makes it much easier to track changes made over time.  Because I was upgrading from 9.0.5, I can see the exact changes 9.1 upgrade has made.  For example, to see web feature changes,     index="_configtracker" (data.path=*/system/default/web-features.conf) | spath path=data.changes{} | fields - data.changes{}.* | mvexpand data.changes{} | spath input=data.changes{} | spath input=data.changes{} path=properties{} | fields - properties{}.* | mvexpand properties{} | spath input=properties{} | stats latest(*_value) as *_value by data.action name stanza data.path _time | eval data.path = replace('data.path', ".*/[sS]plunk/etc", "") | fieldformat _time = strftime(_time, "%F") | table name *_value stanza data.* _time     On my laptop instance (defaults), this shows name new_value old_value stanza data.action data.path _time disable_highcharts_accessibility false   feature:highcharts_accessibility update /system/default/web-features.conf 2023-09-08 enable_acuif_pages false   feature::windows_rce update /system/default/web-features.conf 2023-09-08 enable_autoformatted_comments false   feature:search_auto_format update /system/default/web-features.conf 2023-09-08 enable_dashboards_external_content_restriction true   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 enable_dashboards_redirection_restriction true   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 enable_events_viz true   feature:dashboard_studio update /system/default/web-features.conf 2023-09-08 enable_home_vnext true   feature:page_migration update /system/default/web-features.conf 2023-09-08 enable_inputs_on_canvas true   feature:dashboard_studio update /system/default/web-features.conf 2023-09-08 enable_jQuery2 false true feature:quarantine_files update /system/default/web-features.conf 2023-09-08 enable_search_v2_endpoint false   feature:search_v2_endpoint update /system/default/web-features.conf 2023-09-08 enable_share_job_control true   feature:share_job update /system/default/web-features.conf 2023-09-08 enable_show_hide true   feature:dashboard_studio update /system/default/web-features.conf 2023-09-08 enable_triggered_alerts_vnext true   feature:page_migration update /system/default/web-features.conf 2023-09-08 enable_unsupported_hotlinked_imports false true feature:quarantine_files update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.flowmilldocs docs.flowmill.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.rigorhelp help.rigor.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkapps apps.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkbase splunkbase.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkbasesplunk splunkbase.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkdev dev.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkdocs docs.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkdownload www.splunk.com/download   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunklantern lantern.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkproducts www.splunk.com/products   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.splunkui splunkui.splunk.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 internal.dashboards_trusted_domain.victoropshelp help.victorops.com   feature:dashboards_csp update /system/default/web-features.conf 2023-09-08 I see that you just upgraded from 8 to 9 so this new index doesn't contain data from your upgrade.  But you can manually ingest $SPLUNK_HOME/var/log/splunkd/migration.log.* as a one-time job, then do a similar search     source=*/splunk/migration.log.* (data.path=*/system/default/web-features.conf) | spath path=data.changes{} | fields - data.changes{}.* | mvexpand data.changes{} | spath input=data.changes{} | spath input=data.changes{} path=properties{} | fields - properties{}.* | mvexpand properties{} | spath input=properties{} | stats latest(*_value) as *_value by data.action name stanza data.path _time | eval data.path = replace('data.path', ".*/[sS]plunk/etc", "") | fieldformat _time = strftime(_time, "%F") | table name *_value stanza data.* _time     If your system has lots of history, the output will be numerous.  You should probably limit search to the last archived migration.log. (The current one is created after your upgrade, so historic data is not in.) Hope this helps

Yer I guess I was more interested in pushing up the changes we have already made, and before we started with our next lot of changes seeing if we could merge them in.. if that is the case we might just keep our own branch.. but of a shame really, opening it up can produce some pretty good changes (and not waiting on splunk to implement them).