topic Re: greater than, less than operator changed to xml code, after table command? in Splunk Search

greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Mon, 19 May 2025 08:23:20 GMT

Hello ,
My splunk query is simple:

index=abc,source=xxx.trc
| transaction host source max events=100000
| table _time host source _raw

Now when i execute this until transaction command, it is fine "<", ">" they appear as it is.

But when i give table command, "<", ">" changed to "<" and ">"

Is there anyway i can prevent this?

Re: greater than, less than operator changed to xml code, after table command?

ITWhisperer — Mon, 19 May 2025 08:38:48 GMT

The table command doesn't of itself modify the contents of fields. How are you displaying the contents of the fields?

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Mon, 19 May 2025 08:49:57 GMT

I have exactly copied my splunk query. My final results are _time, host,source,_raw, there are no more fields in it, whole of the event is in _raw

The one highlighted in green is, when executed till transaction. The one in pink is with Table command.

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Mon, 19 May 2025 08:54:03 GMT

But there are many fields inside _raw, so when i execute, table *, there is no problem with that.

BUt when the whole data comes under _raw, those operator changes to xml values.

Re: greater than, less than operator changed to xml code, after table command?

PickleRick — Mon, 19 May 2025 10:42:53 GMT

Can't reproduce.

| makeresults count=100
| eval _raw="2025-05-19 12:38:40 aaa <something> bbb <something else> let's make this event long. Or at least long-ish. reason=we'll see how it works <br> &lt;<how about <now>/>&rt; No change. Thisisfine...",host="a",source="b"
| transaction maxevents=10000 host source
| table _time host source _raw

Splunk 9.3.0. Works as it should.

Re: greater than, less than operator changed to xml code, after table command?

ITWhisperer — Mon, 19 May 2025 10:58:48 GMT

Can't reproduce either - please share your dashboard/report search so we can see what else might be going on?

Re: greater than, less than operator changed to xml code, after table command?

isoutamo — Mon, 19 May 2025 14:51:52 GMT

When you are modifying simple xml dashbords with GUI and you are mixing source and UI options that editor covert those values between < and >

To avoid this you should use only source mode and even add <![CDATA[….]]> inside query tags.

Re: greater than, less than operator changed to xml code, after table command?

bowesmana — Mon, 19 May 2025 23:37:32 GMT

If you search for only that first single event in that time

index=abc,source=xxx.trc GetDbfRecordFromCache

do nothing else, but then look at the _raw event in the display, are the characters encoded in the data or are then <>?

If you then open the event with the little arrow and select Show Source

what does the raw event data look like - is it encoded or not?

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Tue, 20 May 2025 06:18:40 GMT

No, it is not coded. Operators are there.

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Tue, 20 May 2025 06:20:16 GMT

Yes, it is working for me, for other data sources. This one particularly creating problem.

So just wanted to know, what should i check?

Re: greater than, less than operator changed to xml code, after table command?

PickleRick — Tue, 20 May 2025 07:01:24 GMT

To be fully honest, I have no idea what's going on if this is indeed the only thing that's happening. Is this the output in the search app window? Or is it an output of some dashboard panel powered by the search you've provided?

Anyway, I'd start with checking if just listing raw events causes the same issue. If it does, add more and more commands one by one to see when the issue appears.

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Tue, 20 May 2025 07:14:35 GMT

this is happening, on search page. Not even created dashboard

Re: greater than, less than operator changed to xml code, after table command?

sarvesh_11 — Tue, 20 May 2025 07:16:02 GMT

this is on search app window, not created dashboard now. But accepting it would be the same behaviour

Re: greater than, less than operator changed to xml code, after table command?

PickleRick — Tue, 20 May 2025 08:26:51 GMT

OK. This is very very strange. I've had logs with < and > signs many times over my years of Splunk experience and never noticed such behaviour.

It is possible that you're triggering some obscure bug so it's important to narrow down its scope (as I wrote earlier - try to pinpoint the exact moment when this issue appears - whether it's the transaction command, the table command after transaction or maybe it is happening with the table command without transaction as well). And it's most probably a support case material.

Re: greater than, less than operator changed to xml code, after table command?

yuanliu — Tue, 20 May 2025 14:56:56 GMT

As others weighed in, I cannot reproduce this, either. Here is a test code according to your description:

index = _internal "<" sourcetype=splunkd | transaction thread_id | table _raw

Here, I'm including a transaction, followed by a table command. Please see if you get any weird artifact. For me, nothing unusual: