greater than, less than operator changed to xml code, after table command?

[sarvesh_11]

Hello ,
My splunk query is simple:

index=abc,source=xxx.trc
| transaction host source max events=100000
| table _time host source _raw

Now when i execute this until transaction command, it is fine "<", ">" they appear as it is.

But when i give table command, "<", ">" changed to "&lt;" and "&gt;"

Is there anyway i can prevent this?

[yuanliu]

As others weighed in, I cannot reproduce this, either.  Here is a test code according to your description:

index = _internal "<" sourcetype=splunkd
| transaction thread_id
| table _raw

Here, I'm including a transaction, followed by a table command.  Please see if you get any weird artifact.  For me, nothing unusual:

[isoutamo]

When you are modifying simple xml dashbords with GUI and you are mixing source and UI options that editor covert those values between < and &gt;

To avoid this you should use only source mode and even add <![CDATA[….]]> inside query tags. 

[sarvesh_11]

this is happening, on search page. Not even created dashboard

[PickleRick]

Can't reproduce.

| makeresults count=100
| eval _raw="2025-05-19 12:38:40 aaa <something> bbb <something else> let's make this event long. Or at least long-ish. reason=we'll see how it works <br> &lt;<how about <now>/>&rt; No change. Thisisfine...",host="a",source="b"
| transaction maxevents=10000 host source
| table _time host source _raw

Splunk 9.3.0. Works as it should.

[sarvesh_11]

Yes, it is working for me, for other data sources. This one particularly creating problem.

So just wanted to know, what should i check?

[PickleRick]

To be fully honest, I have no idea what's going on if this is indeed the only thing that's happening. Is this the output in the search app window? Or is it an output of some dashboard panel powered by the search you've provided?

Anyway, I'd start with checking if just listing raw events causes the same issue. If it does, add more and more commands one by one to see when the issue appears.

[sarvesh_11]

this is on search app window, not created dashboard now. But accepting it would be the same behaviour

[PickleRick]

OK. This is very very strange. I've had logs with < and > signs many times over my years of Splunk experience and never noticed such behaviour.

It is possible that you're triggering some obscure bug so it's important to narrow down its scope (as I wrote earlier - try to pinpoint the exact moment when this issue appears - whether it's the transaction command, the table command after transaction or maybe it is happening with the table command without transaction as well). And it's most probably a support case material.

[sarvesh_11]

But there are many fields inside _raw, so when i execute, table *, there is no problem with that. 

BUt when the whole data comes under _raw, those operator changes to xml values.

[ITWhisperer]

Can't reproduce either - please share your dashboard/report search so we can see what else might be going on?

[ITWhisperer]

The table command doesn't of itself modify the contents of fields. How are you displaying the contents of the fields?

[sarvesh_11]

I have exactly copied my splunk query. My final results are _time, host,source,_raw, there are no more fields in it, whole of the event is in _raw

The one highlighted in green is, when executed till transaction. The one in pink is with Table command.

[bowesmana]

If you search for only that first single event in that time

index=abc,source=xxx.trc GetDbfRecordFromCache

do nothing else, but then look at the _raw event in the display, are the characters encoded in the data or are then <>?

If you then open the event with the little arrow and select Show Source

what does the raw event data look like - is it encoded or not?

[sarvesh_11]

No, it is not coded. Operators are there.