topic Re: Hidden Search using Advance XML in Splunk Search

Hidden Search using Advance XML

nikhilmehra79 — Fri, 07 Mar 2014 06:13:01 GMT

so i have hidden search in my advance XML file in v5. works perfect until i need to modify my search to extend some regex - now the whole search string on search panel works fine but when i try to take the samelogic to advance xml in my app it starts throwing syntax error on xmlfile.

Reason i think is that ..... is not liking a tag in search

SO here is line which is throwing syntax error:

((source="ABC.csv") AND (SH)) | rex field=_raw "(?.),(?.)" | avg(Value)

i think it is not liking a tag and in ....what should i be doing differently?

Re: Hidden Search using Advance XML

nikhilmehra79 — Fri, 07 Mar 2014 06:24:11 GMT

i think i found the answer it has to be lt and gt to escape.

Re: Hidden Search using Advance XML

MuS — Fri, 07 Mar 2014 08:45:26 GMT

you have to use the < for < and the > for > in your XML code. Another method would be to use your search inside a CDATA tag. For more information read the docs on Simplified XML http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/OverviewofSimplifiedXML

cheers, MuS

Re: Hidden Search using Advance XML

redc — Mon, 31 Mar 2014 16:48:51 GMT

I like to be able to copy-paste my searches in/out of my dashboards, so I always wrap my searches in CDATA tags. So yours would be:

<param name="search"><![CDATA[((source="ABC.csv") AND (SH)) | rex field=_raw "(?<hostname>.*),(?<value>.*)" | avg(Value)]]></param>

This way, you can copy your search into the Search view and run it without having to manually change < and > back to < and >, respectively, and vice versa.