<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: XML error defining view in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38680#M1800</link>
    <description>&lt;P&gt;Can you post the xml?  Normally this happens when you don't have a closing tag on a xml field.  I'm curious if the \d is be prased out as a closed field that doesn't exist and causing the error.  &lt;/P&gt;

&lt;P&gt;If you can't post your xml, if you remove the \d's does the error go away?&lt;/P&gt;

&lt;P&gt;Weblogic message codes in the past 24 hours index=main sourcetype="weblogic" "BEA-*)"|top BEA_MSG_NO limit=10000 -25h -1m&lt;/P&gt;

&lt;P&gt;if so, then you should create a macro for your search above and use the macro name in place of the search.&lt;/P&gt;</description>
    <pubDate>Fri, 27 Aug 2010 23:08:38 GMT</pubDate>
    <dc:creator>bbingham</dc:creator>
    <dc:date>2010-08-27T23:08:38Z</dc:date>
    <item>
      <title>XML error defining view</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38679#M1799</link>
      <description>&lt;P&gt;I'm receiving the following error when adding a row to my dashboard View: &lt;/P&gt;

&lt;P&gt;"Encountered the following error while trying to update: In handler 'views': Not valid XML:   Web Serv..."&lt;/P&gt;

&lt;P&gt;Here's what I added:&lt;/P&gt;

&lt;P&gt;
      
         Weblogic message codes in the past 24 hours
            index=main sourcetype="weblogic" "BEA-\d\d\d\d\d\d)"|top BEA_MSG_NO limit=10000
            -25h
            -1m
      
   &lt;/P&gt;

&lt;P&gt;As far as I can tell, it &lt;EM&gt;looks&lt;/EM&gt; okay. Am I missing something? &lt;/P&gt;

&lt;P&gt;Thanks!&lt;/P&gt;</description>
      <pubDate>Fri, 27 Aug 2010 21:06:26 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38679#M1799</guid>
      <dc:creator>Branden</dc:creator>
      <dc:date>2010-08-27T21:06:26Z</dc:date>
    </item>
    <item>
      <title>Re: XML error defining view</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38680#M1800</link>
      <description>&lt;P&gt;Can you post the xml?  Normally this happens when you don't have a closing tag on a xml field.  I'm curious if the \d is be prased out as a closed field that doesn't exist and causing the error.  &lt;/P&gt;

&lt;P&gt;If you can't post your xml, if you remove the \d's does the error go away?&lt;/P&gt;

&lt;P&gt;Weblogic message codes in the past 24 hours index=main sourcetype="weblogic" "BEA-*)"|top BEA_MSG_NO limit=10000 -25h -1m&lt;/P&gt;

&lt;P&gt;if so, then you should create a macro for your search above and use the macro name in place of the search.&lt;/P&gt;</description>
      <pubDate>Fri, 27 Aug 2010 23:08:38 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38680#M1800</guid>
      <dc:creator>bbingham</dc:creator>
      <dc:date>2010-08-27T23:08:38Z</dc:date>
    </item>
    <item>
      <title>Re: XML error defining view</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38681#M1801</link>
      <description>&lt;P&gt;I can't seem to post the XML on here. It just shows up blank...&lt;BR /&gt;
I did double-check the closing tags and everything looks okay there. I also tried removing the \d's, but I still have the problem. &lt;BR /&gt;
I suspect the problem is with the search string (everything else is a copy/paste from a previous row):&lt;BR /&gt;
sourcetype="weblogic" "&lt;BEA-&gt;BEA-\d\d\d\d\d\d)"|stats count by BEA_MSG_NO&lt;/BEA-&gt;&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 09:16:49 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38681#M1801</guid>
      <dc:creator>Branden</dc:creator>
      <dc:date>2020-09-28T09:16:49Z</dc:date>
    </item>
    <item>
      <title>Re: XML error defining view</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38682#M1802</link>
      <description>&lt;P&gt;You may have to enclose the string in a set of &lt;CODE&gt;&amp;lt;[CDATA[...]]&amp;gt;&lt;/CODE&gt; tags, and if you use the &lt;CODE&gt;code sample&lt;/CODE&gt; button in the editor, it will reformat pasted code so it is literally displayed.&lt;/P&gt;</description>
      <pubDate>Mon, 06 Sep 2010 08:03:09 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/XML-error-defining-view/m-p/38682#M1802</guid>
      <dc:creator>gkanapathy</dc:creator>
      <dc:date>2010-09-06T08:03:09Z</dc:date>
    </item>
  </channel>
</rss>

