- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Splunk Simple XML : Invalid character entry in XML...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Splunk Simple XML : Invalid character entry in XML help with CDATA in href
hi UI gurus,
we have a simple requirement to display certain links in a dashboard. All is good until there is invalid (un-encoded) characters involved. then if I use [[CDATA]] then Splunk simple XML takes the values as literal
Below is dashboard we want to achieve
<dashboard>
<label>test HREF CDATA</label>
<row>
<html>
<h1>
HREF test with un-encoded characters
</h1>
<li>Lookup Links
<ul>
<li>My Lookup =>
<a href="../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv">Link</a>
</li>
</ul>
</li>
</html>
</row>
</dashboard>
Since the href is "un-encoded", this complains. When we change the <a> link as below
<![CDATA[<a href="../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv">Link</a>]]>
Then splunk XML does not render href properly.
What's the best way to use "href" links properly in Simple XML?
PS: Even <link> don't like & in the URL as below also have same problem
<link>
../lookup_editor/owner=nobody&namespace=search&lookup=xyz.csv&type=csv
</link>
xx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how about $url|u$?
<drilldown>
<set token="a_link">$click.value2$</set>
<eval token="url">trim(mvindex(split($a_link$,"("),1),")")</eval>
<link target="_blank">
<![CDATA[ https://httpbin.org/json ]]></link>
</drilldown>
this works
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Got the gist of the logic. Thanks again. If you want to put as answer, will mark as "answer"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
but in the above, where are we passing the "token" to the link URL?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you write statically, you only have to convert this problem when writing it, right?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
