I'm doing a query to return the text part of the log, but when using it on my dashboard it gives this error message: Value node <query> is not supposed to have children
my query:
index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message
My dashboard:
<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message/>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>
Angle brackets etc. need to be encoded when used in the dashboard XML
<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>
Angle brackets etc. need to be encoded when used in the dashboard XML
<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>
It worked for me, thank you so much!
Try this.
<panel>
<single>
<title>Meu titulo</title>
<search>
<query>index=... user Passed-Authentication earliest=@d
| rex field=_raw "mdm-tlv=ac-user-agent=(?<message>.*?),"
| table message </query>
</search>
<option name="height">96</option>
</single>
</panel>
KV