Dashboards & Visualizations

In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem
New Member

Hello.

I've got a query that i'm trying to save as a Dashboard Panel. I have used the SOH character in my query and this is causing the below errors when saving. Could anyone advise please?

Argument 'eai:data' contains invalid character : ...

0 Karma

p3t3rm00r3
New Member

You're better off cleaning the data first;

you can do this at the sourcetype level in the props.conf by adding;

SEDCMD-ccremove=s/\x01/|/g

Or at the search line with

rex mode="sed" "s/\x01/|/g"

That will replace your fix SOH with a pipe delimiter. You can then use an | extract pairdelim="|" kvdelim="="

this will automatically extract your kv pairs

or you can replace the SOH in your rex with \W (rex for not a word character) so..
"\W455=(\w+)"

0 Karma

p3t3rm00r3
New Member

It's better to clean the data first;

Put this in your props.conf for your sourcetype
SEDCMD-ccremove=s/\x01/|/g

or on the search line

| rex mode="sed" "s/\x01/|/g"

after that you'll have a pipe delimiter for your kv pairs, you can rex the field or use and extract pairdelim to get your field.

0 Karma

kechem
New Member

See attached image, does anybody know? alt text

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kechem,

Try including your search in CDATA

<query><![CDATA["your search with SOH"]]></query>
Happy Splunking!
0 Karma

kechem
New Member

Argument 'eai:data' contains invalid character : BBG FIX audit per ECN ID -24h@h now

0 Karma

Vijeta
Influencer

what is the character, can you try using / ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...