Dashboards & Visualizations

In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem
New Member

Hello.

I've got a query that i'm trying to save as a Dashboard Panel. I have used the SOH character in my query and this is causing the below errors when saving. Could anyone advise please?

Argument 'eai:data' contains invalid character : ...

0 Karma

p3t3rm00r3
New Member

You're better off cleaning the data first;

you can do this at the sourcetype level in the props.conf by adding;

SEDCMD-ccremove=s/\x01/|/g

Or at the search line with

rex mode="sed" "s/\x01/|/g"

That will replace your fix SOH with a pipe delimiter. You can then use an | extract pairdelim="|" kvdelim="="

this will automatically extract your kv pairs

or you can replace the SOH in your rex with \W (rex for not a word character) so..
"\W455=(\w+)"

0 Karma

p3t3rm00r3
New Member

It's better to clean the data first;

Put this in your props.conf for your sourcetype
SEDCMD-ccremove=s/\x01/|/g

or on the search line

| rex mode="sed" "s/\x01/|/g"

after that you'll have a pipe delimiter for your kv pairs, you can rex the field or use and extract pairdelim to get your field.

0 Karma

kechem
New Member

See attached image, does anybody know? alt text

0 Karma

renjith_nair
Legend

@kechem,

Try including your search in CDATA

<query><![CDATA["your search with SOH"]]></query>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

kechem
New Member

Argument 'eai:data' contains invalid character : BBG FIX audit per ECN ID -24h@h now

0 Karma

Vijeta
Influencer

what is the character, can you try using / ?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...