Splunk Search

XML with embedded REX in hidden searches

jgolovich
New Member

I am reworking the Symantec Endoint Manager Dashboard since for the life of me it won't work. As a result, I have embedded my rex statements in the hidden searches to provide the just in time data. If I run the search as a straight search, it provides me the data I am looking for.

Based on that, do you see any reason why this is not working?

            <module name="HiddenSearch" layoutPanel="panel_row2_col3" group="Top Infections By Computer Name" autoRun="T$
                    <param name="search"><![CDATA[
                    | eventtype="sep_virusfound"| rex "Computer name: (?P<sep_computername>[^,]+)" | top sep_computername
                    ]]></param>

                    <module name="HiddenChartFormatter">
                            <param name="chart">pie</param>

                            <module name="FlashChart" />

                    </module>
            </module>
0 Karma

Ayn
Legend

First, it seems your paste is missing some stuff? "autoRun=T$".

Anyway just looking at the pasted data as it is, this should give a syntax error. The search starts with "|eventtype..." but the leading pipe character shouldn't be there.

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...