Dashboards & Visualizations

XML dashboard errors at startup

jambajuice
Communicator

I can successfully run the following search from within Splunk:

sourcetype=ossim "Event received" ((plugin_id>=1001 AND plugin_id<=1131) OR plugin_id=1597) | lookup ossim_plugins plugin_id OUTPUT plugin_name | timechart count by plugin_name

I've tried to insert this search into a dashboard as follows:

  <chart>
    <title>IDS Events by Plugin (60 Minutes)</title>
    <searchString>sourcetype=ossim "Event received" ((plugin_id>=1001 AND plugin_id<=1131) OR plugin_id=1597) | lookup ossim_plugins plugin_id OUTPUT plugin_name | timechart count by plugin_name</searchString>
    <earliestTime>-1h</earliestTime>
    <option name="charting.chart">area</option>
    <option name="charting.legend.placement">right</option>
    <option name="charting.chart.stackMode">stacked</option>
    <option name="charting.chart.nullValueMode">connect</option>        
  </chart>

When I restart Splunk, I see the following message from the console:

Error while parsing path to file not well-formed (invalid token): line 6, column 88

What am I doing wrong here?

Thanks!

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

I'd suspect that the unescaped < and > are causing the XML validator to complain. A quick fix would be to wrap the searchString in a CDATA block or individually XML escape the unsafe characters. Alternately, you could refer to a saved search by name, which might be considered cleaner.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...