Splunk Search

Splunk query working fine in search but not working in dashboard which has single display

vn50b7z
Engager

I have the below query which works fine in the 'Search' but when I take the same query to a dashboard which has panel with <single> display the query is giving syntax error.

<source query> | rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType | dedup prnType.

Error in dashboard

Unexpected close tag

Please help me what is wrong with the query

@vn50b7z 

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @vn50b7z,

I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,

Please try below;

| rex field=_raw "\"printerType\":\"(?&lt;prnType&gt;[^\"]+)\"" | table prnType
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @vn50b7z,

I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,

Please try below;

| rex field=_raw "\"printerType\":\"(?&lt;prnType&gt;[^\"]+)\"" | table prnType
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

vn50b7z
Engager

Yes this worked. Thanks for your help

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Another option is use 

<![CDATA[ ....
| rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType
]]>

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...