Unable to use API's to manage Dashboard Studio

Applicability

Description

Attempting to use Splunk APIs to manage dashboards using Dashboard Studio results in the API response including additional and unnecessary ‘![CDATA’ elements. Due to this, the same response cannot be used to clone or update the dashboard, unless the response is cleaned up.

The issue here is that the response from the GET endpoint of dashboard studio adds more CDATA elements to eai:data. So, the eai:data from the GET response cannot be used directly as a valid payload.

Investigation

When using the Splunk API's to manage dashboards, the number of CDATA elements goes in this order-

1. Start of the whole dashboard.

2. For the definition. 

3. For ending the same definition.

4. For hidden elements.

5.  For ending the whole dashboard.

The structure of the elements is mentioned below :-

><![CDATA[<dashboard version="2" theme="dark">
<label>Sample Dashboard</label>
.
.
<definition><![CDATA[
{
"visualizations": {
"viz_FjzwMaVe": {
.
.
.
<![CDATA[></definition>
.
.
.
<meta type="hiddenElements"><![CDATA[
{ .
.
]]]]><![CDATA[></meta>
</dashboard>]]

Resolution

1. The original dashboard payload contains the CDATA section. In the GET XML response, this payload is returned in the <s:key name=“eai:data”> block within a CDATA section.

2. As the CDATA section cannot contain a nested CDATA section per the XML standard it must be encoded, so the closing CDATA tag ]]> is encoded as ]]]]><![CDATA[>. 
By correctly replacing these occurrence in the payload it allows the retrieved payload to be resubmitted as a new dashboard successfully. 

3. If output_mode=json is added to the original request to create the Dashboard studio, the response will not wrap the eai:data property with a CDATA. However, this will return a JSON response instead of XML. 

4.Using output_mode as json for the automation it is working as expected.