help me with dashboard XML

[sravankaripe]

i am finding difficulty with dashboard XML beacause of

tag SubErrorCode
please help me with this

  <search>
   <query>-------------| rex "\"subErrorCode\":\"(?<SubErrorCode>w\w\w_\d+)"| dedup  SubErrorCode |table SubErrorCode </query>
  </search>

[sravankaripe · Accepted solution]

https://answers.splunk.com/answers/3435/escape-and-in-the-xml-of-dashboards.html

[sravankaripe]

i got it by using escape characters

[aaraneta_splunk]

@sravankaripe: Did your answer provide a working solution to your question? If yes, don't forget to click "Accept".

[sravankaripe]

Ok, it's working for me

[sravankaripe]

-------------| rex "\"subErrorCode\":\"(?<SubErrorCode&gtw\w\w_\d+)"| dedup SubErrorCode |table SubErrorCode

[sravankaripe]

tag SubErrorCode