Value node <query> is not supposed to have children

[carinahOliveira]

I'm doing a query to return the text part of the log, but when using it on my dashboard it gives this error message: Value node <query> is not supposed to have children

my query:

index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message

My dashboard:

<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message/>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>

 I believe the error is due to <message>, but I'm new to splunk

[ITWhisperer · Accepted solution]

Angle brackets etc. need to be encoded when used in the dashboard XML

<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?&lt;message&gt;.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>

[carinahOliveira]

It worked for me, thank you so much!

[kamlesh_vaghela]

@carinahOliveira 

Try this.

<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>

KV