I get the following error when I try to use "eval" inside my searchTemplate for an interactive dashboard that I am building.
Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 13: StartTag: invalid element name
< form >
< searchtemplate >
sourcetype="syslog" | ... |
eval range=case( (date_hour>=3 AND date_hour<=4), "in", (date_hour<3 OR date_hour>4), "out" ) | timechart ... | eval ...
< /searchtemplate >
< /form>
Anybody know what would cause that exception to be thrown as soon as I try to add the first eval ?
Does < searchTemplate > not like an eval ?
Thanks
< and > are special characters in XML, so you have to escape them.
You can either replace your < characters with <
and your > characters with >
or you can wrap the entire contents of the
<searchtemplate><![CDATA[
sourcetype="syslog" | ... | eval range=case( (date_hour>=3 AND date_hour<=4), "in", (date_hour<3 OR date_hour>4), "out" ) | timechart ... | eval ...
]]>