topic Re: Cannot identify unexpected close tag in Dashboards & Visualizations

Cannot identify unexpected close tag

kphansdge — Wed, 08 Sep 2021 18:40:50 GMT

Hi,

I am trying to make use of this dashboard from this forum thread:

Solved: Ever wonder which dashboards are being used and wh... - Splunk Community

but I am running into an error saying "Unexpected close tag" on this line:

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

Please advise.

Also I am adding this directly to the Source of a dashboard instead of a search is that right?

Re: Cannot identify unexpected close tag

ITWhisperer — Wed, 08 Sep 2021 21:31:49 GMT

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to < and > respectively, or edit the search from ui mode and paste the search in?

Re: Cannot identify unexpected close tag

kphansdge — Wed, 08 Sep 2021 21:34:50 GMT

@ITWhisperer wrote:
It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to < and > respectively, or edit the search from ui mode and paste the search in?

Thank you for your response. I'm looking at the code and I don't see < and > in the rex expression could you please elaborate? I'm fairly new to coding

Re: Cannot identify unexpected close tag

ITWhisperer — Wed, 08 Sep 2021 21:39:07 GMT

Re: Cannot identify unexpected close tag

kphansdge — Wed, 08 Sep 2021 22:11:24 GMT

Thank you! It's working successfully. 🙂