Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Splunk Simple XML : Invalid character entry in XML...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Simple XML : Invalid character entry in XML help with CDATA in href
hi UI gurus,
we have a simple requirement to display certain links in a dashboard. All is good until there is invalid (un-encoded) characters involved. then if I use [[CDATA]] then Splunk simple XML takes the values as literal
Below is dashboard we want to achieve
<dashboard>
<label>test HREF CDATA</label>
<row>
<html>
<h1>
HREF test with un-encoded characters
</h1>
<li>Lookup Links
<ul>
<li>My Lookup =>
<a href="../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv">Link</a>
</li>
</ul>
</li>
</html>
</row>
</dashboard>
Since the href is "un-encoded", this complains. When we change the <a> link as below
<![CDATA[<a href="../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv">Link</a>]]>
Then splunk XML does not render href properly.
What's the best way to use "href" links properly in Simple XML?
PS: Even <link> don't like & in the URL as below also have same problem
<link>
../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv
</link>
xx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how about $url|u$?
<drilldown>
<set token="a_link">$click.value2$</set>
<eval token="url">trim(mvindex(split($a_link$,"("),1),")")</eval>
<link target="_blank">
<![CDATA[ https://httpbin.org/json ]]></link>
</drilldown>
this works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got the gist of the logic. Thanks again. If you want to put as answer, will mark as "answer"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
but in the above, where are we passing the "token" to the link URL?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you write statically, you only have to convert this problem when writing it, right?
Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability for AI
