Dashboards & Visualizations
Highlighted

Escape < and > in the xml of dashboards

Motivator

Hi

I got the following error when I tried to save a dashboard after editing its xml:

Encountered the following error while trying to update: In handler 'views': Not valid XML: <view template="dashboard.html....

< and > characters are part of my search String because I'm using the rex search command

..
<module name="HiddenSearch" autoRun="True">
  <param name="search">| savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason</param>
..
.

How do those characters have to be escaped?

Tags (2)
Highlighted

Re: Escape < and > in the xml of dashboards

Splunk Employee
Splunk Employee

There are two ways:

  • Use &lt; for < and &gt; for >. You should also use &amp; for any & and some people like to use &quot; for ".
  • Enclose the entire search string in a CDATA tag: `(?.)" | stats count ]]>'

I personally think that it's a lot clearer to just use CDATA so your search query is readable:

 <module name="HiddenSearch" autoRun="True">
    <param name="search"><![CDATA[
      | savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason
    ]]></param>
    ...
 ...
 ...

View solution in original post