SPL gets garbled in simple XML

[token2]

Hello, I have SPL that when opened into a search from the dashboard has good working SPL, for example

| rex field=_raw "\"stuff\"+\smaximum=\"100\"\>(?P<Score>[^\<]*)"

in simple XML (when editing in the webUI 'source' and when opening the XML files in an editor) some of the characters get garbled.

| rex field=_raw "\"stuff\"+\smaximum=\"100\"\&gt;(?P&lt;Score&gt;[^\&lt;]*)"

Seems that the ">" gets garbled into "&gt;" and "<" into "&lt;"

Another example is " | rex field=Message "Member:\s(?P<UserAdd>[\s\S]*?Account Name"

the < and > get mutated to: rex field=Message "Member:\s(%3FP&lt;UserAdd&gt;[\s\S]*%3F)Account Name"

So ? is %3F

< is &lt;

> &gt;

[isoutamo]

Those are escaped characters which splunk changes to this form when you are using dashboard editor. You could avoid this using “source”-mode with editor and add <![CDATA[ .... your query ... ]]> to source code.

r. Ismo

[anilchaithu · Accepted solution]

@token2 

This is expected in xml for special characters like &, >, < etc. Refer the document & attached image to avoid this issue

https://docs.splunk.com/Documentation/Splunk/8.0.4/Viz/OverviewofSimplifiedXML

Hope this helps