Canary

 

For users who maintain/develop Sideview XML views.

If you are a Sideview Utils user, or if you are an administrator of one or more internally-developed Sideview XML views or apps, here’s what you need to know.

The “Advanced XML” systems are being removed in Splunk 8, and there are actions you should take before upgrading.

If you are first learning about this, here are more details — Technically when you go to a Sideview XML view in Splunk (i.e. a view that was developed using User Interface modules from Sideview Utils) you are technically running an “Advanced XML” view in Splunk. This remains true even though technically Sideview Utils has all this time been patching or replacing most of the actual running code underneath.

Splunk deprecated the “Advanced XML” systems long ago, and in Splunk 8 they are finally removing them. But it’s OK – we are ready, and your custom Sideview XML views have a good chance of continuing to run on Splunk 8 and beyond. Read on.

Beginning now and going forward you should install the Canary app as well as Sideview Utils.

Sideview has developed and released a new front end to Splunk that runs as a Splunk app called “Canary”.

Although Canary’s main mission is to ensure that Sideview’s own commercial apps continue to run on Splunk 8 in the absence of the “Advanced XML” systems, it also happens to be broadly backwards-compatible to a decent subset of the views that could be created with Sideview Utils. Whether or not your particular views and dashboards are within this subset, is the critical question.

It runs in both Splunk 7.X and Splunk 8.X, so you can start testing all this now before upgrading to Splunk 8.

It’s possible that some, or even most of your Sideview XML views, will just run in Canary. And if not, it will tell you why not.

Canary can read the legacy “Advanced XML” view format, and it has some ability to automatically convert module and param config over to what will work in Canary.
If on the other hand it encounters something that it cannot convert, it will tell you. It may even have suggestions on the conversion you need to do.
Also there is a tool on the Canary homepage that will scan all views across all apps and allow you to see all these error messages and warnings and suggestions at once for a given view or app.

Custom CSS and Custom JS will likely be a problem

Custom CSS – The Canary UI has a different look and feel and the pages have a different HTML structure. If you have invested a lot of time and energy in custom CSS, it may take some work to make a given view render nicely again.

Custom JS – this is basically a whole new user interface framework, so if you’ve written a lot of “customBehavior” code, it’s not particularly likely that this code will work out of the box. Contact us though as the work to convert may actually be surprisingly minimal.

Will Canary be free for Internal Use the way Sideview Utils was
We have not yet finalized the long term licensing. While it’s not very likely that Canary will have the same “Free Internal Use License Agreement” terms that Sideview Utils had, it is likely that there will be some “freemium” model where there’s still a free license option that allows some amount of internal use.

We will be at the Splunk User Conference!
We won’t have a booth there this year, however Nick will be giving two talks. Note that neither of these talks is about Canary or even Sideview, but come anyway because they’re interesting.

1) Master Joining without using join
2) Wayback machine – Driving around in Splunk 1.0, 2.0 and 3.4

and Nick and Rich will both be floating around the “Ask The Experts” area and likely quite easy to find in the Community areas overall.  For more info (which we’ll try to keep up to date), see this blog post on conf19.