Splunk Search

XML with embedded REX in hidden searches

jgolovich
New Member

I am reworking the Symantec Endoint Manager Dashboard since for the life of me it won't work. As a result, I have embedded my rex statements in the hidden searches to provide the just in time data. If I run the search as a straight search, it provides me the data I am looking for.

Based on that, do you see any reason why this is not working?

            <module name="HiddenSearch" layoutPanel="panel_row2_col3" group="Top Infections By Computer Name" autoRun="T$
                    <param name="search"><![CDATA[
                    | eventtype="sep_virusfound"| rex "Computer name: (?P<sep_computername>[^,]+)" | top sep_computername
                    ]]></param>

                    <module name="HiddenChartFormatter">
                            <param name="chart">pie</param>

                            <module name="FlashChart" />

                    </module>
            </module>
0 Karma

Ayn
Legend

First, it seems your paste is missing some stuff? "autoRun=T$".

Anyway just looking at the pasted data as it is, this should give a syntax error. The search starts with "|eventtype..." but the leading pipe character shouldn't be there.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...