Dashboards & Visualizations

In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem
New Member

Hello.

I've got a query that i'm trying to save as a Dashboard Panel. I have used the SOH character in my query and this is causing the below errors when saving. Could anyone advise please?

Argument 'eai:data' contains invalid character : ...

0 Karma

p3t3rm00r3
New Member

You're better off cleaning the data first;

you can do this at the sourcetype level in the props.conf by adding;

SEDCMD-ccremove=s/\x01/|/g

Or at the search line with

rex mode="sed" "s/\x01/|/g"

That will replace your fix SOH with a pipe delimiter. You can then use an | extract pairdelim="|" kvdelim="="

this will automatically extract your kv pairs

or you can replace the SOH in your rex with \W (rex for not a word character) so..
"\W455=(\w+)"

0 Karma

p3t3rm00r3
New Member

It's better to clean the data first;

Put this in your props.conf for your sourcetype
SEDCMD-ccremove=s/\x01/|/g

or on the search line

| rex mode="sed" "s/\x01/|/g"

after that you'll have a pipe delimiter for your kv pairs, you can rex the field or use and extract pairdelim to get your field.

0 Karma

kechem
New Member

See attached image, does anybody know? alt text

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@kechem,

Try including your search in CDATA

<query><![CDATA["your search with SOH"]]></query>
Happy Splunking!
0 Karma

kechem
New Member

Argument 'eai:data' contains invalid character : BBG FIX audit per ECN ID -24h@h now

0 Karma

Vijeta
Influencer

what is the character, can you try using / ?

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...