Dashboards & Visualizations
Highlighted

How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Path Finder

I am using a rex expression to filter results for a drop-down created for a dashboard. I'm using xml to develop the dashboard and it seems values under this bracket < > are not allowed for use in xml. While saving the xml, I'm getting the following pop up:

"Encountered the following error while trying to update: In handler "views" error parsing xml on line 140: Premature end of data in tag view line 1"

Please suggest if any other way I can achieve below.

< module name="Search" layoutPanel="panelrow1col1" autoRun="True" >
< param name="search" >$name$ sourcetype="$server$" $logLevel$ "PhoneNo"
| rex field=_raw "PhoneNo*=(?< PhoneNo >\d{8})+*"
| stats count by name, logLevel, PhoneNo,

0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Splunk Employee
Splunk Employee

add a CDATA wrapper around your search.

Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Path Finder

I tried with CDATA, I am not able to extract value which i was getting using rex. If you can pls share syntax for CDATA wrapper.

0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Splunk Employee
Splunk Employee
0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Path Finder

If I am wrapping (PhoneNo=(?< PhoneNo >d{8})+") within CDATA.. the rex search syntax is not working, any suggestions?

0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Explorer

Hi Satya2p,

have you fixed your issue if you fixed the issue, please provide me the solution to fix the issue and i am facing the same issue and didn't able to find the solution for the same.

0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Path Finder

Need to replace the "less than" (<) and "greater than" (>) brackets with the HTML rendering of the same: "& l t ;" and "& g t ;" (but remove the spaces in between the characters).

You can test this by saving any Splunk search with brackets as a dashboard panel, then editing the dashboard to view the XML source. For example, your search string:

| rex field=_raw "PhoneNo*=(?< PhoneNo >\d{8})+*"

when placed in a Splunk XML dashboard becomes:

| rex field=_raw "PhoneNo*=(?%lt;PhoneNo %gt;\d{8})+*"
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Explorer

I had to replace less than and greater than signs with the following & l t ; and & g t ; (Without spaces)

(?P & l t ; accountname & g t ; .*)

https://docs.splunk.com/Documentation/Splunk/8.0.0/Viz/OverviewofSimplifiedXML

0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Motivator

Reference for the future - use the dashboard GUI search editor, then copy and paste from the XML generated for you. It's the easiest way if you have lots of HTML encoded characters.

Cheers,
Jacob
0 Karma
Highlighted

Re: How to prevent getting an error using brackets < > in a rex expression while creating a dashboard view in XML?

Esteemed Legend

Do Edit -> Source -> CTRL-F then type >, then CTRL-F, then type &gt;, then click the All to the right of Replace. Do the same thing for < but use &lt;. Then click Save.