topic In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character? in Dashboards & Visualizations

In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem — Thu, 27 Sep 2018 12:41:30 GMT

Hello.

I've got a query that i'm trying to save as a Dashboard Panel. I have used the SOH character in my query and this is causing the below errors when saving. Could anyone advise please?

Argument 'eai:data' contains invalid character : ...

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

Vijeta — Thu, 27 Sep 2018 14:52:58 GMT

what is the character, can you try using / ?

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

renjith_nair — Fri, 28 Sep 2018 03:24:50 GMT

@kechem,

Try including your search in CDATA

<query><![CDATA["your search with SOH"]]></query>

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem — Fri, 28 Sep 2018 07:57:51 GMT

Argument 'eai:data' contains invalid character : BBG FIX audit per ECN ID -24h@h now

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem — Fri, 28 Sep 2018 08:11:29 GMT

See attached image, does anybody know?

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

p3t3rm00r3 — Mon, 13 Jan 2020 17:03:44 GMT

It's better to clean the data first;

Put this in your props.conf for your sourcetype
SEDCMD-ccremove=s/\x01/|/g

or on the search line

| rex mode="sed" "s/\x01/|/g"

after that you'll have a pipe delimiter for your kv pairs, you can rex the field or use and extract pairdelim to get your field.

Re: In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

p3t3rm00r3 — Mon, 13 Jan 2020 17:12:23 GMT

You're better off cleaning the data first;

you can do this at the sourcetype level in the props.conf by adding;

SEDCMD-ccremove=s/\x01/|/g

Or at the search line with

rex mode="sed" "s/\x01/|/g"

That will replace your fix SOH with a pipe delimiter. You can then use an | extract pairdelim="|" kvdelim="="

this will automatically extract your kv pairs

or you can replace the SOH in your rex with \W (rex for not a word character) so..
"\W455=(\w+)"