Cannot identify unexpected close tag

[kphansdge]

Hi,

I am trying to make use of this dashboard from this forum thread:

Solved: Ever wonder which dashboards are being used and wh... - Splunk Community

but I am running into an error saying "Unexpected close tag" on this line:

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

Please advise.

Also I am adding this directly to the Source of a dashboard instead of a search is that right?

[ITWhisperer]

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?

[kphansdge]

---

@ITWhisperer wrote:

It looks like this might be from the source view of the dashboard, in which case, the < and > in the rex expression should be converted to &lt; and &gt; respectively, or edit the search from ui mode and paste the search in?

---

Thank you for your response. I'm looking at the code and I don't see <  and > in the rex expression could you please elaborate? I'm fairly new to coding

[ITWhisperer · Accepted solution]

<query>index="_internal" user!="-" sourcetype=splunkd_ui_access "en-US/app" | rex field=referer "en-US/app/(?<app>[^/]+)/(?<dashboard>[^?/\s]+)" | search dashboard!="job_management" dashboard!="dbinfo" dashboard!="*en-US" dashboard!="search" dashboard!="home"

[kphansdge]

Thank you! It's working successfully. 🙂