Splunk Search

Hidden Search using Advance XML

nikhilmehra79
Path Finder

so i have hidden search in my advance XML file in v5. works perfect until i need to modify my search to extend some regex - now the whole search string on search panel works fine but when i try to take the samelogic to advance xml in my app it starts throwing syntax error on xmlfile.

Reason i think is that ..... is not liking a tag in search

SO here is line which is throwing syntax error:

((source="ABC.csv") AND (SH)) | rex field=_raw "(?.),(?.)" | avg(Value)

i think it is not liking a tag and in ....what should i be doing differently?

Tags (3)
0 Karma
1 Solution

nikhilmehra79
Path Finder

i think i found the answer it has to be lt and gt to escape.

View solution in original post

0 Karma

redc
Builder

I like to be able to copy-paste my searches in/out of my dashboards, so I always wrap my searches in CDATA tags. So yours would be:

<param name="search"><![CDATA[((source="ABC.csv") AND (SH)) | rex field=_raw "(?<hostname>.*),(?<value>.*)" | avg(Value)]]></param>

This way, you can copy your search into the Search view and run it without having to manually change < and > back to < and >, respectively, and vice versa.

0 Karma

nikhilmehra79
Path Finder

i think i found the answer it has to be lt and gt to escape.

0 Karma

MuS
SplunkTrust
SplunkTrust

you have to use the &lt; for < and the &gt; for > in your XML code. Another method would be to use your search inside a CDATA tag. For more information read the docs on Simplified XML http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/OverviewofSimplifiedXML

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...