Splunk Search

Search Query Within Link is Showing "Unexpected close tag" Error


We are trying to run a rex command inside of a custom drill down link. Here is the relevant XML Code we are using:

      <link target="_blank">search?q=index=exampleIndex* | spath deployment | search deployment="cf-deployment" event_type="LogMessage" source_type= "RTR" msg=*login* | rex field=msg "response_time:(?<resptime>.+?(\D)*[.][0-9]*)" &amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>

We are receiving the error specified in the title as well as an error that says "Error parsing XML on line 39: Premature end of data in tag form line 1". We tried adding html escape characters with the query as specified in other user questions, but those haven't worked either. Does anybody have an idea?

Esteemed Legend

Drilldowns are tricky. I always start with the Splunk Dashboard Examples app, find one similar, clone it and go from there:


0 Karma


<resptime> is being read as an HTML tag, and </link> arrives before </resptime> (which doesn't exist), so </link> is unexpected.

Change <resptime> to &lt;resptime&gt;.

If that doesn't fix it completely, then you also may need to change all the spaces to their HTML equivalent (%20 or whatever).

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...