- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Making xml valid
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi guys, i am having an issue with the xml script in the last line but i cant seem to figure out how to make it valid as i have.
Have tried double quotes but does not work.
data-options='{
"app": "simple_xml_examples",
"preview": true,
"search": ""sourcetype = a NOT (is OR you OR the OR chinese)' title="*" | eval words=split(title," ") | stats count words""}
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To post special characters into Splunk answers insert a new line and then indent 4 spaces
like this
<xml for ever>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To post special characters into Splunk answers insert a new line and then indent 4 spaces
like this
<xml for ever>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The xml should look like so (row should be inside search)
<search id="tagcloud_search1">
<query>index=_internal source=sourcetype = a NOT (is OR you OR the OR chinese)' title="*" | eval words=split(title," ") | stats count words""}</query>
<row>
<panel>
<html>
<h2>Pipeline</h2>
<div id="tagcloud1"
class="splunk-view"
data-require="app/social/components/tagcloud/tagcloud"
data-options='{
"minFontSize": 14,
"maxFontSize": 55,
"managerid": "tagcloud_search1",
"valueField": "count",
"labelField": "words"
}'>
</div>
</html>
</panel>
</row>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry took so long to reply. I did encounter another error after trying "Premature end of data in tag form line 1"
im not entire sure what it means.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you pasted in the xml I posted exactly you will not have encountered an error. Premature end probably means you have an un nested element. Do you have something like this?
<search>
</search>
<row>
</row>
That will throw the premature error. Instead your xml should look like this:
<search>
<row>
</row>
</search>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes yes. i did modify the xml. ive copied exactly. it prompted this error now "should not combine visualizations and panels."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx. after toying with it again. I noticed where i did wrong. Having the code within the same row.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi below is the code snippet.
XML
<search id="tagcloud_search1">
<query>index=_internal source=sourcetype = a NOT (is OR you OR the OR chinese)' title="*" | eval words=split(title," ") | stats count words""}</query>
</search>
<row>
<panel>
<html>
<h2>Pipeline</h2>
<div id="tagcloud1"
class="splunk-view"
data-require="app/social/components/tagcloud/tagcloud"
data-options='{
"minFontSize": 14,
"maxFontSize": 55,
"managerid": "tagcloud_search1",
"valueField": "count",
"labelField": "words"
}'>
</div>
</html>
</panel>
*autodiscovery.js*
require.config({
paths: {
"app": "../app"
}
});
require(['splunkjs/mvc/simplexml/ready!'], function(){
require(['splunkjs/ready!'], function(){
// The splunkjs/ready loader script will automatically instantiate all elements
// declared in the dashboard's HTML.
});
});
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanks for the reply. but i do not get it. I would have to add it before for a
</xml>
close ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry I thought you were wondering how to add xml to your post. 🙂 Your question is not very clear. You say you are having trouble with an xml script. Which script? Is this a dashboard view? How do you know its invalid? What you have posted is not xml -it looks more like JSON. Can you provide some more context over what you are trying to achieve and what error you are getting
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your response.
Actually what i am trying to do is modify one of the word cloud scripts from the splunk examples (tag cloud with tokens) . I been trying to modify or change the query line to pick up my customized query. But it always prompts back for invalid xml.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can you post the full xml ?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
