I am running splunk query which is scheduled to run in every minute to pull the events of last minute. Randomly i getting this xml parse error.
Splunk query :- search index=os sourcetype=cpu all earliest=-2m@m latest=-1m@m |dedup host| eval fields=split(raw,\" \") | eval num=mvindex(fields,-1)| eval cpuUtilization = 100-num |eval humanreadabletime=strftime(time, \"%Y-%m-%d %H:%M:%S\") |table humanreadabletime host cpuUtilization
Error :-
java.lang.RuntimeException: java.lang.RuntimeException: ParseError at [row,col]:[363,318]
Message: The character sequence "]]>" must not appear in content unless used to mark the end of a CDATA section.
at com.splunk.Job.refresh(Job.java:900)
at com.splunk.Job.isReady(Job.java:823)
at com.splunk.Job.isDone(Job.java:770)
at MAPDashboardMain$1.run(MAPDashboardMain.java:175)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
at java.util.concurrent.FutureTask$Sync.innerRunAndReset(FutureTask.java:351)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:178)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:178)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
at java.lang.Thread.run(Thread.java:729)
Caused by: java.lang.RuntimeException: ParseError at [row,col]:[363,318]
Message: The character sequence "]]>" must not appear in content unless used to mark the end of a CDATA section.
at com.splunk.AtomObject.scan(AtomObject.java:198)
at com.splunk.AtomEntry.parseValue(AtomEntry.java:220)
at com.splunk.AtomEntry.parseDict(AtomEntry.java:143)
at com.splunk.AtomEntry.parseStructure(AtomEntry.java:189)
at com.splunk.AtomEntry.parseValue(AtomEntry.java:230)
at com.splunk.AtomEntry.parseDict(AtomEntry.java:143)
at com.splunk.AtomEntry.parseContent(AtomEntry.java:118)
at com.splunk.AtomEntry.init(AtomEntry.java:95)
at com.splunk.AtomObject.load(AtomObject.java:121)
at com.splunk.AtomEntry.parse(AtomEntry.java:77)
at com.splunk.AtomEntry.parseStream(AtomEntry.java:57)
at com.splunk.Job.refresh(Job.java:898)
... 11 more
Caused by: com.sun.xml.stream.XMLStreamException2: ParseError at [row,col]:[363,318]
Message: The character sequence "]]>" must not appear in content unless used to mark the end of a CDATA section.
at com.sun.xml.stream.XMLReaderImpl.next(XMLReaderImpl.java:604)
at com.splunk.AtomObject.scan(AtomObject.java:193)
... 22 more
Can someone please explain why this occuring ?
