An error occurred while fetching data when ">" or "<" are used in a dashboard panel using a base search
When trying to open the search inside the panel Error 403 Forbidden occurs
There is no error with "="
There is no error when the entire search is place in the panel
I am using Splunk7.0.1
you need to encode the
> in the XML like this:
<query>| stats count AS CNT by index | eval MN=12 | where CNT < MN
or modify the search string using the edit mode and then the magnifier to edit the search.
Hope this helps ...
I wish it was that easy, the xml would have never allowed me to save a code with <
The editor used here translated my < to <
Okay, I tried it with this run everywhere search :
<dashboard> <label>foobar</label> <row> <panel> <table> <title>table</title> <search id="baseSearch"> <query>| tstats count WHERE index=_* by index source | stats count by index source</query> <sampleRatio>1</sampleRatio> </search> <option name="count">100</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> <panel> <table> <title>table</title> <search base="baseSearch"> <query>| stats count AS CNT by index | eval MN="12" | where CNT < MN</query> </search> <option name="count">10</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard>
switched the lesser or greater than in every possible way, placed the base and post-processing search all over the place, and never got any error message like you mentioned in the question.
My suggestion here is to check for any weird copy paste characters in the XML. Other than that I'm out of ideas
¯\_(ツ)_/¯ , beside of course check the job inspector or any Splunk logs for additional information what is causing this ....
@marlykono, also if you are on Splunk 7.0.1 and editing the dashboard in Simple XML Editor, the editor should highlight the row with spooky character and mention some detail around the error. Can you add that screenshot, if your issue is not resolved yet?
@marlykono, as suggested by @MuS, easy way to do it is Edit the Panel in UI and then apply your search. As you would have noticed search panel does accept
> characters and need not be escaped.
Only when you are editing in SimpleXML or sometimes in Web Framework (HTML/Splunk JS Code), you might have to escape the character like
>. Hope the difference is clear!