Splunk Search

Search will run in search app but not as hiddensearch

jedatt01
Builder

I have a search that will work fine manually in the search app, but when I try to incorporate it as a hidden search in my custom app xml it gets the following error.
Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 54: StartTag: invalid element name

Search Criteria:
sourcetype="orion__detail_daily" OR sourcetype="gomez_data" | eval percent_avail=coalesce(percent_avail,avail) | eval tier = if(sourcetype="Orion_Server_Detail_Daily","Server",if(sourcetype="Orion_Application_Detail_Daily","Application","User")) | stats avg(percent_avail) as appAvail by tier | eval grnColumn = if(appAvail>95, appAvail, 0) | eval yelColumn = if((appAvail<96* **AND appAvail***>89), appAvail, 0) | eval redColumn = if(appAvail<90,* appAvail, 0) | fields - appAvail

The parts in the search criteria that I have in bold are showing up as blue and what I have in italics are green in the xml editor. I believe this is where it's having the problem.

Tags (1)
0 Karma
1 Solution

dshpritz
SplunkTrust
SplunkTrust

I haven't experienced this first hand, but my guess would be that the problem is that the "<" and ">" need to be converted to valid entities. So &lt; and &gt;.

HTH,

Dave

View solution in original post

dshpritz
SplunkTrust
SplunkTrust

I haven't experienced this first hand, but my guess would be that the problem is that the "<" and ">" need to be converted to valid entities. So &lt; and &gt;.

HTH,

Dave

jedatt01
Builder

Thanks Dave, this worked perfectly!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...