topic Re: removal of special character < question in Splunk Search

removal of special character < question

hermeslxxv — Sat, 26 Mar 2016 23:33:20 GMT

Hello Everyone,
I am trying to format some syslog data for a dashboard output. I have no idea how to remove the < character within a search template. when I use replace in a search it works fine, but the template wont accept the string. ive also tried rex mode sed with no luck.

| replace "*< cr> ]" WITH "*" IN CmdSet
:note there is no space in front of the cr.

Any suggestions are appreciated!

Re: removal of special character < question

martin_mueller — Sun, 27 Mar 2016 01:10:01 GMT

If you're editing XML by hand, you need to replace < with > or wrap the entire search string in <![CDATA[search string]]>. Else the opening angle bracket gets interpreted as the start of an XML tag.

If you're editing through the UI the replacement should happen automagically.

Re: removal of special character < question

hermeslxxv — Sun, 27 Mar 2016 01:31:36 GMT

wrapping the entire string worked perfectly, thank you