Dashboards & Visualizations

Why am I getting the error "Unexpected cloase tage> at the end of the end of the query?

POR160893
Builder

Hi,

I am creating a dashboard where one of the queries is using the rex command.

However, in the XML, I am getting the error "Unexpected cloase tage> at the end of the end of the query.

The query is as follows:
index="ABC" sourcetype=XYZ "Logout User:"
| rex field=_raw "Logout User:\s+(?<user>\S+)"
| top 10 user

I know it is something to do with the rex command but not sure how to correct it .... can you please help?

 

Many thanks as always,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The < and > should be converted to &lt; and &gt; respectively.

If you edit your dashboard in UI mode rather than source mode, you can edit the search for the panel and just copy the search you have as is and the < and > will be automatically converted for you.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The < and > should be converted to &lt; and &gt; respectively.

If you edit your dashboard in UI mode rather than source mode, you can edit the search for the panel and just copy the search you have as is and the < and > will be automatically converted for you.

POR160893
Builder

Perfect, thank you 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...