topic Re: Syntax question about adding custom regex fields into the XML of a dashboard in Splunk Search

Syntax question about adding custom regex fields into the XML of a dashboard

yumology — Wed, 06 Feb 2013 19:24:35 GMT

My search looks like this:

host="myfirewall-fw1" error_code=733100 | rex field=_raw "Current average rate is (?< avg >[^\']+) per second" | timechart max(avg)

Upon adding it to the XML of a dashboard it looks like this:

< chart >
    < title >Number of Drop Rate Exceeded messages over time< /title >
    < searchTemplate >host="myfirewall-fw1" error_code=733100 | rex field=_raw "Current average rate is (?< avg >[^\']+) per second" | timechart max(avg)< /searchTemplate >
    < option name="charting.chart" >line< /option >
    < option name="charting.legend.placement" >right< /option >
< /chart >

The problems is that when "< avg >" is inside the XML tage < searchTemplate > I get bugs with an error saying "error parsing XML".
So how do I escape out the less than and greater than signs to put that in my search in my view?

Edit: The less than and greater than symbols won't show up in the post unless I add a space after them. Ignore those spaces.

Re: Syntax question about adding custom regex fields into the XML of a dashboard

Rob — Wed, 06 Feb 2013 19:31:43 GMT

You might want to try using the search for your dashboard in a normal search first to refine it before putting it in your dashboard XML.

I think the problem is escaping the backslash.

[^\']+

try

[^\\']+

You may need to use a third backslash in order to escape out the slash all the way and have both the backslash and the single quote as part of the negated character class.

Re: Syntax question about adding custom regex fields into the XML of a dashboard

yumology — Wed, 06 Feb 2013 20:34:56 GMT

I can't really see your code because XML isn't permmited to be displayed properly...
It is not the \ that is the problem. It is simply the fact that the XML thinks it sees an XML tag inside an XML tag and errors on the parsing.
I was able to put this into it's on search then call it in the dashboard. However, my dashboard has a form element so my search actually looks like this:

host=$host$ error_code=733100 | ...

The form grabs the host and puts it in the $host$ variable. It doesn't seem to pass into a search though and so it's not working.

Re: Syntax question about adding custom regex fields into the XML of a dashboard

Ron_Naken — Thu, 07 Feb 2013 03:24:53 GMT

The < and > symbols need to be written as you would for HTML. They look like this:

< is (amp)lt;
> is (amp)gt;

** substitute & for (amp) -- I'm not certain how to display them here without substitution.

Re: Syntax question about adding custom regex fields into the XML of a dashboard

Rob — Thu, 07 Feb 2013 20:49:00 GMT

Have you tried checking the search job inspector to see what it tells you when you open that dashboard in a new window?

Re: Syntax question about adding custom regex fields into the XML of a dashboard

yumology — Thu, 07 Feb 2013 20:49:57 GMT

Thanks. This combined with a little more searching helped me find the syntax.

http://splunk-base.splunk.com/answers/3435/escape-and-in-the-xml-of-dashboards?utm_source=supportcase&utm_medium=link&utm_campaign=relatedanswers&utm_term=Syntax+error+when+adding+regex%27s+in+the+XML+of+a+dashboard