Splunk Search

XML with embedded REX in hidden searches

jgolovich
New Member

I am reworking the Symantec Endoint Manager Dashboard since for the life of me it won't work. As a result, I have embedded my rex statements in the hidden searches to provide the just in time data. If I run the search as a straight search, it provides me the data I am looking for.

Based on that, do you see any reason why this is not working?

            <module name="HiddenSearch" layoutPanel="panel_row2_col3" group="Top Infections By Computer Name" autoRun="T$
                    <param name="search"><![CDATA[
                    | eventtype="sep_virusfound"| rex "Computer name: (?P<sep_computername>[^,]+)" | top sep_computername
                    ]]></param>

                    <module name="HiddenChartFormatter">
                            <param name="chart">pie</param>

                            <module name="FlashChart" />

                    </module>
            </module>
0 Karma

Ayn
Legend

First, it seems your paste is missing some stuff? "autoRun=T$".

Anyway just looking at the pasted data as it is, this should give a syntax error. The search starts with "|eventtype..." but the leading pipe character shouldn't be there.

0 Karma
Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...