Hi,
newly created search will not work as part of dashboard
| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6
The error I get when trying to save is
Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 9: StartTag: invalid element name
Lots of the search is showing in RED when added to the dashboard code (but works is pasted into search without the rangemap text)
<search>
<query>| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none</query>
Hi,
I managed to get this working by adding
| fields SANS3 just before the | range
thanks!
Hi,
I managed to get this working by adding
| fields SANS3 just before the | range
thanks!
Hi,
Hope this pastes ok as I cant attach a file (karma points)
SANS 20 OVERVIEW
<panel>
<title>SANS 1</title>
<single>
<title>Authorized & Unauthorized Devices</title>
<search>
| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total | eval value = success/total*100 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
<panel>
<title>SANS 6</title>
<single>
<title>Application Software</title>
<search>
| stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 10 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
<panel>
<title>SANS 11</title>
<single>
<title>Limitation & Control of Network Ports, Protocols</title>
<search>
| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 60 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 70 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 20 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
<panel>
<title>SANS 16</title>
<single>
<title>Account Monitoring & Control</title>
<search>
| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 30 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 25 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 14 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
| stats count as value | eval value = 95 | rangemap field=value elevated=51-84 low=85-100 severe=0-50 default=none
range
value
ellipsisNone
0
visible
visible
visible
linear
linear
false
inherit
radialGauge
50
10
area
gaps
0.01
default
shiny
all
0
ellipsisMiddle
right
search
[0,49,84,100]
[0xd13b3b,0xebe42d,0x7e9f44]
none
Additional Information
I would imagine your search contains characters that interrupt the xml (I can't pinpoint one exactly though).
Have you tried the second solution from the answer to this question? Basically you just enclose your entire search with
<![CDATA[
before and
]]>
after.
Hi,
I tried this and the XML is saving now but its only actually doing the first calculation not the entire part
<query><![CDATA[ | dbquery "database" "SELECT * FROM new_compliancelist"| stats count(eval(FAILED<1)) as success count as total| eval SANS31 = success/total*100 |fields SANS31 | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.2" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.2] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.3" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.3] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.6" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.6] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.7" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.7] | join [ | dbquery "database" "SELECT * FROM SANS20Score" | WHERE SANSID = "3.10" | fields "COMPLIANCE%"| rename COMPLIANCE% as SANS3.10] | eval SANS3=('SANS31'+'SANS3.2'+'SANS3.3'+'SANS3.10'+'SANS3.7'+'SANS3.6')/6 | rangemap field=SANS3 elevated=51-84 low=85-100 severe=0-50 default=none]]></query>
Have you checked what exact search is run when the dashboard is opened?
Hi,
Do you check this by clicking to edit the search string? if so its as expeted
anything weird like it needs to be appendcols rather than join?
hi crosssap,
it is a beacon problem is that has not been closed or badly positioned, can you post all your xml so that we may identify the problem?
Is there another way I can post all of the xml? due to the crazy formatting that comes through