Dashboards & Visualizations

Why am I getting the error "Unexpected cloase tage> at the end of the end of the query?

POR160893
Builder

Hi,

I am creating a dashboard where one of the queries is using the rex command.

However, in the XML, I am getting the error "Unexpected cloase tage> at the end of the end of the query.

The query is as follows:
index="ABC" sourcetype=XYZ "Logout User:"
| rex field=_raw "Logout User:\s+(?<user>\S+)"
| top 10 user

I know it is something to do with the rex command but not sure how to correct it .... can you please help?

 

Many thanks as always,

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

The < and > should be converted to &lt; and &gt; respectively.

If you edit your dashboard in UI mode rather than source mode, you can edit the search for the panel and just copy the search you have as is and the < and > will be automatically converted for you.

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

The < and > should be converted to &lt; and &gt; respectively.

If you edit your dashboard in UI mode rather than source mode, you can edit the search for the panel and just copy the search you have as is and the < and > will be automatically converted for you.

POR160893
Builder

Perfect, thank you :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...