I have the below query which works fine in the 'Search' but when I take the same query to a dashboard which has panel with <single> display the query is giving syntax error.
<source query> | rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType | dedup prnType.
Error in dashboard
Unexpected close tag
Please help me what is wrong with the query
Hi @vn50b7z,
I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,
Please try below;
| rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType
Hi @vn50b7z,
I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,
Please try below;
| rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType
Yes this worked. Thanks for your help
Another option is use
<![CDATA[ ....
| rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType
]]>