Rest API not allowing me to escape ampersands

[bruceclarke]

Hey,

I'm trying to create a dashboard using the rest API. However, I'm running into an issue where it isn't letting me supply an escaped ampersand into the dashboard. Here is an example that fails:

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/data/ui/views/ -d "name=foobar3&eai:data=<dashboard><label>I want to use the ampersand character (%26 or &amp;amp; or &)</label></dashboard>"

How can I add an ampersand to my XML?

[bruceclarke · Accepted solution]

Actually, I was just able to figure out the issue. If you escape the semicolon too, then this will work. So, here is the correct way to create a dashboard that uses an ampersand:

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/data/ui/views/ -d "name=foobar3&eai:data=To use an ampersand, escape both the ampersand %26amp%3B semicolon."

[MuS]

Hi bruceclarke,

Nice finding!
It really looks like this is not supported or a bug; as soon as one add's an & inside the label tag it will be used as XML tag opener. Tried using the XML tag opener![CDATA[ as well without any luck.

My Suggestion: file a bug here http://www.splunk.com/r/bugs

cheers, MuS

[bruceclarke]

I was hoping there would be a workaround. I'll file an issue there and ask about any possible workarounds for the time being. Thanks!

[woodcock]

Why are you using & instead of AND after foobar3? Also, there is no name field for that endpoint's data (although there is a title field). You have to fix those problems first and maybe that is what is causing your search failure. if you really need to escape the &, perhaps you can bypass needing it altogether by using | where match($eai_data$,"RegExHere") and skipping over it with RegEx (wildcards).

[bruceclarke]

Those shouldn't be the issue. I'm able to run the command below just fine. The command below creates a dashboard that's stored as foobar3.xml (on the backend) and the title of the dashboard (on the front end) is "My RESTful dashboard"

curl -k -u admin:changeme https://localhost:8089/servicesNS/nobody/search/data/ui/views/ -d "name=foobar3&eai:data=My RESTful dashboard"

Naturally, the comment field is not showing my dashboard and label XML tags (I guess Splunk Answers assumes it is HTML code), but that's part of the eai:data field as well.