Dashboards & Visualizations

How to upgrade Advanced XML file to simple XML file ?


Hi Team,

I am in a process of updating Splunk to version 8.0 and to Python 3.X.Also, for that I have remove all the usage of Advanced XML and convert it into the simple XML views.
But there are few dashboards/XML which seems to be impossible to convert them back to simple XML.

Could you please guide me the way how can i actually remove advance XML ? Or any kind of leads would be highly appreciated because manually changing them back to simple XML seems like a very tedious task.

For ex:-

APP Name:- Splunk Add for *Nix
Location:- tc_matrix_nix/default/data/ui/views/Setup.xml


<view autoCancelInterval="100" template="search.html">
  <label>Splunk for Unix Add-on: Setup</label>

  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">splunk.search.job</param>
    <param name="clearOnJobDispatch">True</param>
    <param name="maxSize">1</param>
  <module name="TitleBar" layoutPanel="viewHeader">
    <param name="showActionsMenu">False</param>
  <module name="TA_Unix_FTR" layoutPanel="viewHeader">

  <module name="TA_Unix_IFrame" layoutPanel="viewHeader">
    <param name="height">auto</param>

Thanks in advance

0 Karma

Path Finder

convert from XML to html i believe is a current capability from the create dashboard UI.

0 Karma

Path Finder

stuck with same issue, I think we cannot. Its easy to create new dashboards from your spl query than completely fixing xml

0 Karma


Currently from my investigating into this matter, there are no guides on converting advanced xml back to simple xml. Only reference I read can be found from the Changes to Splunk Enterprise

  • *Advanced XML (deprecated in Splunk version 6.3): removed. If possible, replace Advanced XML with Simple XML. For more information about alternatives to Advanced XML available in Splunk Enterprise, see Building customizations for the Splunk platform *
0 Karma

Ultra Champion

setup.xml is a special case. I'm pretty sure you don't want to modify that, as its not a dashboard per-se

From this looks of this, you have a customised version of the Splunk provided *nix app.
Have you looked at the latest version from Splunkbase to identify what has changed.

Seems a lot of work to rebuild everything, and loose the convinence of a Splunk curated app.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...