Splunk Search

setup.xml custom endpoint label newline

klee310
Communicator

I'm trying to put a newline in my label tag in for one of the inputs. Not sure how the newline character should be specified.

This is what I have:

<input field="general_log_encoding_string">
 <label>
 Custom character-encoding name if different from default, ex. BIG-5
 \n\r
 See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details</label>
 <type>text</type>
</input>

But the result comes out like this:

Custom character-encoding name if different from default, ex. BIG-5 \n\r See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details

Any help is greatly appreciated. Thanks

0 Karma

klee310
Communicator

I've checked everywhere, and there doesn't seem to be a solution anywhere. I guess I'll just give up this function. Its bells-and-whistles anyways.

0 Karma

LukeMurphey
Champion

You can do this using a break or paragraph tag. However, you will need to put your HTML in CDATA blocks so that it is ignored by Splunk's XML parser. Below is an updated version of your sample:

<input field="general_log_encoding_string">
 <text>
 Custom character-encoding name if different from default, ex. BIG-5
 <![CDATA[<p>]]> <!-- Note the custom HTML included here -->
 See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details</text>
 <type>text</type>
</input>
0 Karma

LukeMurphey
Champion

Check the internal error log. Open the search app and run a search for:

index=_internal error

0 Karma

klee310
Communicator

not quite sure what you're trying to get at. if I replace the label tag with the text tag, the setup.xml screen doesn't even load up. AttributeError: 'NoneType' object has no attribute 'text'

0 Karma

LukeMurphey
Champion

Try putting the comment in in a text tag as opposed to a label tag. i.e. ...

0 Karma

klee310
Communicator

tried that, and this is what i get:
Custom character-encoding name if different from default, ex. BIG-5

See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...