so i have hidden search in my advance XML file in v5. works perfect until i need to modify my search to extend some regex - now the whole search string on search panel works fine but when i try to take the samelogic to advance xml in my app it starts throwing syntax error on xmlfile.
Reason i think is that
SO here is line which is throwing syntax error:
i think it is not liking a tag
you have to use the
< and the
> in your XML code. Another method would be to use your search inside a
CDATA tag. For more information read the docs on Simplified XML http://docs.splunk.com/Documentation/Splunk/6.0.2/Viz/OverviewofSimplifiedXML
I like to be able to copy-paste my searches in/out of my dashboards, so I always wrap my searches in CDATA tags. So yours would be:
<param name="search"><![CDATA[((source="ABC.csv") AND (SH)) | rex field=_raw "(?<hostname>.*),(?<value>.*)" | avg(Value)]]></param>
This way, you can copy your search into the Search view and run it without having to manually change
> back to < and >, respectively, and vice versa.