Splunk Search

Splunk query working fine in search but not working in dashboard which has single display

vn50b7z
Engager

I have the below query which works fine in the 'Search' but when I take the same query to a dashboard which has panel with <single> display the query is giving syntax error.

<source query> | rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType | dedup prnType.

Error in dashboard

Unexpected close tag

Please help me what is wrong with the query

@vn50b7z 

Labels (2)
0 Karma
1 Solution

scelikok
Champion

Hi @vn50b7z,

I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,

Please try below;

| rex field=_raw "\"printerType\":\"(?&lt;prnType&gt;[^\"]+)\"" | table prnType
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

scelikok
Champion

Hi @vn50b7z,

I think you are adding search into the dashboard source, < and > signs should be change to URL encoding,

Please try below;

| rex field=_raw "\"printerType\":\"(?&lt;prnType&gt;[^\"]+)\"" | table prnType
If this reply helps you an upvote is appreciated.

View solution in original post

0 Karma

vn50b7z
Engager

Yes this worked. Thanks for your help

0 Karma

soutamo
SplunkTrust
SplunkTrust

Another option is use 

<![CDATA[ ....
| rex field=_raw "\"printerType\":\"(?<prnType>[^\"]+)\"" | table prnType
]]>

 

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!