topic Re: Why am I unable to save my search as a query in a dashboard panel? in Splunk Search

Why am I unable to save my search as a query in a dashboard panel?

smudge797 — Wed, 24 Aug 2016 22:14:01 GMT

I have search that works fine when run manually:

sourcetype=WinHostMonTest | rex field=_raw "CommandLine=(?.+[^\n])" | table CmdLine

But when I try to add it into my dashboard, it complains and the closing and will not save:

 <search>
   <query>index=perfmon source=process sourcetype=WinHostMon ProcessId=22864 earliest=$time.earliest$ latest=$time.latest$ host=$Host$ ProcessId=$ProcessID$ | dedup ProcessId | rex field=_raw "CommandLine=(?.+[^\n])" | table CmdLine < / query >

Re: Why am I unable to save my search as a query in a dashboard panel?

MuS — Wed, 24 Aug 2016 23:19:26 GMT

Hi smudge797,

you need to to escape the < and > in the XML using < and > or the <![CDATA[ tag, fine more details in the docs http://docs.splunk.com/Documentation/Splunk/6.4.3/AdvancedDev/AdvancedIntro#Special_characters_in_XML_files

Hope this helps ...

cheers, MuS

Re: Why am I unable to save my search as a query in a dashboard panel?

s2_splunk — Wed, 24 Aug 2016 23:33:04 GMT

If you really coded it like this < / query > i.e. with spaces, you need to remove the spaces to make it a valid XML closing tag: </query>. But maybe this is just a formatting issue.

Re: Why am I unable to save my search as a query in a dashboard panel?

MuS — Wed, 24 Aug 2016 23:45:09 GMT

Oh good spotting!

Re: Why am I unable to save my search as a query in a dashboard panel?

smudge797 — Thu, 25 Aug 2016 03:27:36 GMT

Nope that's just so it would post in here. Went a bit freaky without the spaces.

Re: Why am I unable to save my search as a query in a dashboard panel?

woodcock — Thu, 25 Aug 2016 15:00:14 GMT

Some things need to be encoded (e.g. angle-bracket characters). The easiest way to do this to let splunk do the encoding. First, save the xml with a dummy search that is so basic that Splunk will not be able to complain about it, such as this:

|noop

Then, click Edit Panels (instead of Edit Source) and a Magnifying Glass Icon will appear in the upper-right corner of every panel. Click on this inside your panel and select "Edit Search String". Paste your actual search string into that dialog and click Save. Done.

Re: Why am I unable to save my search as a query in a dashboard panel?

smudge797 — Thu, 25 Aug 2016 15:02:44 GMT

CDATA worked fine. Thanks!

Re: Why am I unable to save my search as a query in a dashboard panel?

smudge797 — Thu, 25 Aug 2016 15:03:37 GMT

Cool work around. Thanks!

Re: Why am I unable to save my search as a query in a dashboard panel?

woodcock — Thu, 25 Aug 2016 15:55:13 GMT

Pick the best answer and click "Accept" to close the Question.