Dashboards & Visualizations

How to add an XML comment to the beginning of our pre-built panel files?

kenoski
Path Finder

We would like to add an XML comment to the beginning of our pre-built panel files.

However, when we have the comment before the element, we get the following error:

Error parsing prebuilt dashboard panel. 

I can't seem to find any documentation that says this is allowed, nor any that says its disallowed.

Does anyone know if this is legal? Or how to get it to work?
It seems like a bug in the parser, otherwise it should ignore the XML comment.

Thanks.

0 Karma
1 Solution

kenoski
Path Finder

After opening up a case with Splunk about this issue, they have created

BUG: SPL-115294 - XML Comment before Tag causes parsing errors

I am waiting to hear if this will be resolved, or not.

Until then, either move the XML comment to the inside of the tag, or use the workaround they provided for me now is to use the following:

<![CDATA[ 
# ======================================================== 
# this is the panel that odes the following 
# second line of comment 
# ======================================================== 
# --> 
]]>
<panel> 

Update:: the CDATA tag can not be before the tag...It causes an error in their editor. See below.

Hope this help someone.

View solution in original post

kenoski
Path Finder

After opening up a case with Splunk about this issue, they have created

BUG: SPL-115294 - XML Comment before Tag causes parsing errors

I am waiting to hear if this will be resolved, or not.

Until then, either move the XML comment to the inside of the tag, or use the workaround they provided for me now is to use the following:

<![CDATA[ 
# ======================================================== 
# this is the panel that odes the following 
# second line of comment 
# ======================================================== 
# --> 
]]>
<panel> 

Update:: the CDATA tag can not be before the tag...It causes an error in their editor. See below.

Hope this help someone.

kenoski
Path Finder

Discussed this with Splunk Support and they have acknowledged this is a problem with Splunk Enterprise 6.2.6, but have decided to not fix it until a later product release.

I was told the parser is being rewritten in 6.4, and it will be working then.

Until then the workaround is to put the panel tag before any comment or CDATA tag.

<panel>
 <!-- 
 # ========================================================
 #   this is the panel that odes the following
 #   second line of comment
 # ========================================================
 # -->
0 Karma

kenoski
Path Finder

Here is an example of the beginning of one of our files.

<!-- 
# ========================================================
#   this is the panel that odes the following
#   second line of comment
# ========================================================
# -->
<panel>
etc.
</panel>

masonmorales
Influencer

It should work. The syntax for XML comments is:

<!-- My comment here -->

Make sure you place it beneath one of your panel tags.

jeffland
SplunkTrust
SplunkTrust

This doesn't work if you place the comment at the beginning of a prebuilt dashboard. Move it after the <panel> tag and you're good to go.

Can't supply any documentation for this unfortunately, simply tried and it worked.

kenoski
Path Finder

So in other words, its a bug in their parser.

0 Karma

kenoski
Path Finder

I added a multiline XML comment before the first line tag, and the parser is complaining with the error I stated in my original post.

The xml code screen is showing the multiline comment as a comment, so the Splunk XML editor believe it is a comment, just not the parser.

0 Karma

jeffland
SplunkTrust
SplunkTrust

I can confirm this works (kinda). Sometimes on larger dashboards, comments may move, but I haven't found out what triggers that behavior.

0 Karma

jeffland
SplunkTrust
SplunkTrust

Correction: it works inside a dashboard, not at the beginning of prebuilt panels.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...