Why am I getting the error "Unexpected cloase tage> at the end of the end of the query?

[POR160893]

Hi,

I am creating a dashboard where one of the queries is using the rex command.

However, in the XML, I am getting the error "Unexpected cloase tage> at the end of the end of the query.

The query is as follows:
index="ABC" sourcetype=XYZ "Logout User:"
| rex field=_raw "Logout User:\s+(?<user>\S+)"
| top 10 user

I know it is something to do with the rex command but not sure how to correct it .... can you please help?

Many thanks as always,

[ITWhisperer · Accepted solution]

The < and > should be converted to &lt; and &gt; respectively.

If you edit your dashboard in UI mode rather than source mode, you can edit the search for the panel and just copy the search you have as is and the < and > will be automatically converted for you.

[POR160893]

Perfect, thank you 🙂