Splunk Search

Why is dashboard XML failing parsing check when splunk is restarted?

vishaloptulink
Explorer

Hi,

I have a dashboard built from a search. The search contains range check for a value.
Search:

    | inputlookup datalookup
    | table TIMESTAMP COMMAND RESULT UTILIZATION
    | search LATITUDE>=$sbound$ LATITUDE<$nbound$ LONGITUDE>=$wbound$ LONGITUDE<$ebound$

This search works without any issues in the Search App, but when I include this in a dashboard and restart splunk, Splunk fails on configuration check. The following is the error:

Checking prerequisites...
    Checking http port [8000]: open
    Checking mgmt port [8089]: open
    Checking appserver port [127.0.0.1:8065]: open
    Checking kvstore port [8191]: open
    Checking configuration... Error while parsing '/opt/splunk/etc/apps/my_app/default/data/ui/views/map_drilldown.xml':
 not well-formed (invalid token): line 27, column 49

This error is pointing to "<" (less than) symbol in the search.

Please help to resolve this issue.

Thank you,

Tags (3)
1 Solution

chanfoli
Builder

Try wrapping your search in a CDATA section as in:

<![CDATA[ 
| inputlookup datalookup
| table TIMESTAMP COMMAND RESULT UTILIZATION
| search LATITUDE>=$sbound$ LATITUDE<$nbound$ LONGITUDE>=$wbound$ LONGITUDE<$ebound$
 ]]>

View solution in original post

chanfoli
Builder

Try wrapping your search in a CDATA section as in:

<![CDATA[ 
| inputlookup datalookup
| table TIMESTAMP COMMAND RESULT UTILIZATION
| search LATITUDE>=$sbound$ LATITUDE<$nbound$ LONGITUDE>=$wbound$ LONGITUDE<$ebound$
 ]]>

vishaloptulink
Explorer

Thank you. That worked.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...