Dashboards & Visualizations

How can I include greater/less than signs in a search in my app's simple xml view

Builder

I'm trying to build a view that has a bunch of charts on it. I thought that finally I had something that the simple xml might be able to handle, but I'm again having trouble.

The problem comes from the fact that my search uses rex to extract a number of fields. rex syntax uses greater- and less-than signs, which Splunk doesn't appear to like.

When I try to update the xml in the manager (as per below), it gives an error "Encountered the following error while trying to update: In handler 'views': Not valid XML:"

Is there a way I can get around this? Is it a bug?

<?xml version='1.0' encoding='utf-8'?> <dashboard> <label>Order statistics from Oracle</label> <row> <chart> <searchString>sourcetype=ORAExtendedOrderHistory* | rex "(?<sample_date>.*?),(?<channel>\w*),(?<booking_system>\w*),(?<Orders>\d*),(?<StopAndLimit>\d*),(?<WorkingOrder>\d*),(?<TotalOrders>\d*),(?<avgRoundTrip>\d*),(?<minRoundTrip>\d*),(?<maxRoundTrip>\d*),(?<avgWeblogic>\d*),(?<minWebLogic>\d*),(?<maxWeblogic>\d*),(?<avgBookingSystem>\d*),(?<minBookingSystem>\d*),(?<maxBookingSystem>\d*)" | search channel=WEB OR channel=MOBILE OR channel=L23G OR channel=iPhone | timechart span=1m sum(TotalOrders) by channel</searchString> <earliestTime>-5h</earliestTime> <option name="charting.chart">area</option> <option name="charting.chartTitle">Total number of Orders</option> <option name="charting.primaryAxisTitle.text">Time</option> <option name="charting.secondaryAxisTitle.text">Order count</option> </chart> </row> </dashboard>

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

You need to encode it to be considered completely valid XML. This means either enclosing text in a CDATA

<![CDATA[questionalble text that includes < and > and & characters]]>

or XML-encoding it, which, if you want to be guaranteed to avoid problems, means encoding

< as &lt;
> as &gt;
& as &amp;
" as &quot;

Most XML parsers will tolerate some of these characters in some data, but not always and not conistently from parser to parser.

View solution in original post

Explorer

The best way to handle similar kind of special character issue is by using Macro in splunk.
Follow the link
Manager » Advanced search >>New Macro

You can find the manager listed at top right corner of your splunk search window.

0 Karma

Splunk Employee
Splunk Employee

You need to encode it to be considered completely valid XML. This means either enclosing text in a CDATA

<![CDATA[questionalble text that includes < and > and & characters]]>

or XML-encoding it, which, if you want to be guaranteed to avoid problems, means encoding

< as &lt;
> as &gt;
& as &amp;
" as &quot;

Most XML parsers will tolerate some of these characters in some data, but not always and not conistently from parser to parser.

View solution in original post

Builder

I tried the CDATA option at least, as it was less work than converting each character, and it works fine. Thanks!

0 Karma

Splunk Employee
Splunk Employee

Try    &gt;   (which is ">") and    &lt;   (which is "<").

0 Karma