Dashboards & Visualizations

Escape < and > in the xml of dashboards

chris
Motivator

Hi

I got the following error when I tried to save a dashboard after editing its xml:

Encountered the following error while trying to update: In handler 'views': Not valid XML: <view template="dashboard.html....

< and > characters are part of my search String because I'm using the rex search command

..
<module name="HiddenSearch" autoRun="True">
  <param name="search">| savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason</param>
..
.

How do those characters have to be escaped?

Tags (2)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There are two ways:

  • Use &lt; for < and &gt; for >. You should also use &amp; for any & and some people like to use &quot; for ".
  • Enclose the entire search string in a CDATA tag: `(?.)" | stats count ]]>'

I personally think that it's a lot clearer to just use CDATA so your search query is readable:

 <module name="HiddenSearch" autoRun="True">
    <param name="search"><![CDATA[
      | savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason
    ]]></param>
    ...
 ...
 ...

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There are two ways:

  • Use &lt; for < and &gt; for >. You should also use &amp; for any & and some people like to use &quot; for ".
  • Enclose the entire search string in a CDATA tag: `(?.)" | stats count ]]>'

I personally think that it's a lot clearer to just use CDATA so your search query is readable:

 <module name="HiddenSearch" autoRun="True">
    <param name="search"><![CDATA[
      | savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason
    ]]></param>
    ...
 ...
 ...
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...