<title> Clam Scan Results </title> <event>
<search> ref="anti-virus scan results">
</search>
<option name="list.drilldown"
>none</option>
Hi @cj04
Hope you are using your code inside dashboard,
please use following code inside dashboard
<row>
<panel>
<event>
<title> Clam Scan Results </title>
<search ref="anti-virus scan results"> </search>
<option name="list.drilldown">none</option>
</event>
</panel>
</row>
Where exactly are you trying to put this text?
The quoted text is Simple XML from a dashboard, not SPL one can put into a search box. It seems like this is being pasted into the Search & Reporting app and the SPL parser is failing on the first '<'.
What problem are you trying to solve with this text?
What do I need to edit so I can post this into the Search & Reporting and get the desired outcome?
What am I trying to solve is from my "Clam Scan Results" I am wanting Splunk to pick those up. I am using this text in the search portion of Splunk, but I am also new to Splunk. How can I properly get this setup where my results are posting in Splunk?