Splunk Search

Why is search query within link is showing "Unexpected close tag" error?

whorst1
Engager

We are trying to run a rex command inside of a custom drill down link. Here is the relevant XML Code we are using:

    <drilldown>
      <link target="_blank">search?q=index=exampleIndex* | spath deployment | search deployment="cf-deployment" event_type="LogMessage" source_type= "RTR" msg=*login* | rex field=msg "response_time:(?<resptime>.+?(\D)*[.][0-9]*)" &amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
    </drilldown>

We are receiving the error specified in the title as well as an error that says "Error parsing XML on line 39: Premature end of data in tag form line 1". We tried adding html escape characters with the query as specified in other user questions, but those haven't worked either. Does anybody have an idea?

Labels (1)

GaryZ
Path Finder

@DalJeanis I'm having the same issue.  I've tried changing my html code to use &lt;code_word&gt;

I get the following error

GaryZ_0-1686769434362.png

 

When I leave it as the following

| rex field = session "(?<session_text>.*_)[\D]*"

 

I would get the "Unexpected close tag" error message

0 Karma

woodcock
Esteemed Legend

Drilldowns are tricky. I always start with the Splunk Dashboard Examples app, find one similar, clone it and go from there:

https://splunkbase.splunk.com/app/1603/

0 Karma

DalJeanis
Legend

<resptime> is being read as an HTML tag, and </link> arrives before </resptime> (which doesn't exist), so </link> is unexpected.

Change <resptime> to &lt;resptime&gt;.

If that doesn't fix it completely, then you also may need to change all the spaces to their HTML equivalent (%20 or whatever).

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...