Splunk Search

search fails in xml file

DTERM
Contributor

The following search works fine in the Splunk search:

index=mydata | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

When I take that same search and place it in an xml file like:

  <searchTemplate>

index=dns | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

It fails. (That search in the XML starts and ends with the searchTemplate tags although I don't see those in this post, though they are there.) I get the following error when trying to start Splunk:

Checking configuration... Error while parsing '/opt/splunk/etc/apps/myApp/default/data/ui/views/source.xml':

mismatched tag: line 6, column 4

I don't see the mismatched tag. What is the problem with the XML?

Thanks.

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

The problem with your search is the ">" and "<". The angel brackets are treated as part of XML tags. Replace those with the HTML entities & lt; and & gt; . Hope that fixes your problem.

View solution in original post

bmacias84
Champion

The problem with your search is the ">" and "<". The angel brackets are treated as part of XML tags. Replace those with the HTML entities & lt; and & gt; . Hope that fixes your problem.

DTERM
Contributor

Based on this response, I've created the following search:

index=data | rex "\s+IP\s+(?<src_ip> \d+.\d+.\d+.\d+).(?<src_port>\S+)\s+>\s+(?<dest_ip>\d+.\d+.\d+.\d+).(?<dest_port>[a-z0-9]+):\s+" | top src_ip

This still fails in the XML file. Is there anything within Splunk that helps resolve such regular expressions? Why does this not work? What is incorrect?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...