Dashboards & Visualizations

In a query being saved to a dashboard panel, how do I escape the Start of Header (SOH) character?

kechem
New Member

Hello.

I've got a query that i'm trying to save as a Dashboard Panel. I have used the SOH character in my query and this is causing the below errors when saving. Could anyone advise please?

Argument 'eai:data' contains invalid character : ...

0 Karma

p3t3rm00r3
New Member

You're better off cleaning the data first;

you can do this at the sourcetype level in the props.conf by adding;

SEDCMD-ccremove=s/\x01/|/g

Or at the search line with

rex mode="sed" "s/\x01/|/g"

That will replace your fix SOH with a pipe delimiter. You can then use an | extract pairdelim="|" kvdelim="="

this will automatically extract your kv pairs

or you can replace the SOH in your rex with \W (rex for not a word character) so..
"\W455=(\w+)"

0 Karma

p3t3rm00r3
New Member

It's better to clean the data first;

Put this in your props.conf for your sourcetype
SEDCMD-ccremove=s/\x01/|/g

or on the search line

| rex mode="sed" "s/\x01/|/g"

after that you'll have a pipe delimiter for your kv pairs, you can rex the field or use and extract pairdelim to get your field.

0 Karma

kechem
New Member

See attached image, does anybody know? alt text

0 Karma

renjith_nair
Legend

@kechem,

Try including your search in CDATA

<query><![CDATA["your search with SOH"]]></query>
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

kechem
New Member

Argument 'eai:data' contains invalid character : BBG FIX audit per ECN ID -24h@h now

0 Karma

Vijeta
Influencer

what is the character, can you try using / ?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...