Dashboards & Visualizations

Cannot identify unexpected close tag

kphansdge
Engager

Hi,

 

I am trying to make use of this dashboard from this forum thread:

Solved: Ever wonder which dashboards are being used and wh... - Splunk Community

but I am running into an error saying "Unexpected close tag" on this line:

 

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

 

Please advise.

 

Also I am adding this directly to the Source of a dashboard instead of a search is that right?

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?

0 Karma

kphansdge
Engager

@ITWhisperer wrote:

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?


Thank you for your response. I'm looking at the code and I don't see <  and > in the rex expression could you please elaborate? I'm fairly new to coding

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

0 Karma

kphansdge
Engager

Thank you! It's working successfully. 🙂

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...