All Apps and Add-ons

Sideview, $search$, REX, and the HTML module

cramasta
Builder

I was messing with the $search$, $postProcess$ variables in my dashboard the other day to show the search string using the html module. I noticed that the field name of the matching group for any regex will be removed. Is there a work around for this. Only thing I could think of was to use the Redirector + Button module to launch a flashtimeline view loading the $search$ | $postProcess$

For example if my search has

| rex "data/(?<ServiceName>[\S][^\/]+)"

the following will be displayed in the HTML module

| rex "data/(?[\S][^\/]+)"

*haha looks like the text box here on answers will do the same thing unless I enclose the entire rex with a backtick

1 Solution

sideview
SplunkTrust
SplunkTrust

If you're on the latest version of 2.6.5 which only released a few days ago, you can set the
htmlEscapeKeys param of the HTML module to

 `<param name="htmlEscapeKeys">search,postProcess</param>` 

and that will tell it to remove unsafe html characters before inserting those tokens. What's happening is that by default the HTML module assumes you don't want such characters escaped, because for instance you might be trying to insert your own chunk of dynamically constructed HTML into the page.

If you have a version older than 2.6.5, there were ways of doing this but they were clunky. Here's one way: http://answers.splunk.com/answers/85210/unable-to-use-foo-value-containing-xml-in-html-module and another way was to just put in a couple lines of customBehavior Javascript (not everyone's favorite option certainly).

Update to the latest version though because now it's very easy.

http://sideviewapps.com/apps/sideview-utils

http://sideviewapps.com/apps/sideview-utils/release-notes/

View solution in original post

sideview
SplunkTrust
SplunkTrust

If you're on the latest version of 2.6.5 which only released a few days ago, you can set the
htmlEscapeKeys param of the HTML module to

 `<param name="htmlEscapeKeys">search,postProcess</param>` 

and that will tell it to remove unsafe html characters before inserting those tokens. What's happening is that by default the HTML module assumes you don't want such characters escaped, because for instance you might be trying to insert your own chunk of dynamically constructed HTML into the page.

If you have a version older than 2.6.5, there were ways of doing this but they were clunky. Here's one way: http://answers.splunk.com/answers/85210/unable-to-use-foo-value-containing-xml-in-html-module and another way was to just put in a couple lines of customBehavior Javascript (not everyone's favorite option certainly).

Update to the latest version though because now it's very easy.

http://sideviewapps.com/apps/sideview-utils

http://sideviewapps.com/apps/sideview-utils/release-notes/

Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...