I am using a rex expression to filter results for a drop-down created for a dashboard. I'm using xml to develop the dashboard and it seems values under this bracket < > are not allowed for use in xml. While saving the xml, I'm getting the following pop up:
"Encountered the following error while trying to update: In handler "views" error parsing xml on line 140: Premature end of data in tag view line 1"
Please suggest if any other way I can achieve below.
< module name="Search" layoutPanel="panel_row1_col1" autoRun="True" >
< param name="search" >$name$ sourcetype="$server$" $logLevel$ "PhoneNo"
| rex field=_raw "PhoneNo*=(?< PhoneNo >\d{8})+*"
| stats count by name, logLevel, PhoneNo,
The easiest way I've found is to create a macro of your query. The use the macro in your dashboard query statement. Be sure permissions are properly set.
<query>`your_query`</query>
Do Edit
-> Source
-> CTRL-F
then type >
, then CTRL-F
, then type >
, then click the All
to the right of Replace
. Do the same thing for <
but use <
. Then click Save
.
Need to replace the "less than" (<) and "greater than" (>) brackets with the HTML rendering of the same: "& l t ;" and "& g t ;" (but remove the spaces in between the characters).
You can test this by saving any Splunk search with brackets as a dashboard panel, then editing the dashboard to view the XML source. For example, your search string:
| rex field=_raw "PhoneNo*=(?< PhoneNo >\d{8})+*"
when placed in a Splunk XML dashboard becomes:
| rex field=_raw "PhoneNo*=(?%lt;PhoneNo %gt;\d{8})+*"
I had to replace less than and greater than signs with the following & l t ; and & g t ; (Without spaces)
(?P & l t ; accountname & g t ; .*)
https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/OverviewofSimplifiedXML
Reference for the future - use the dashboard GUI search editor, then copy and paste from the XML generated for you. It's the easiest way if you have lots of HTML encoded characters.
add a CDATA wrapper around your search.
I tried with CDATA, I am not able to extract value which i was getting using rex. If you can pls share syntax for CDATA wrapper.
If I am wrapping (PhoneNo=(?< PhoneNo >d{8})+") within CDATA.. the rex search syntax is not working, any suggestions?
Hi Satya2p,
have you fixed your issue if you fixed the issue, please provide me the solution to fix the issue and i am facing the same issue and didn't able to find the solution for the same.