Splunk Search

greater than, less than operator changed to xml code, after table command?

sarvesh_11
Communicator

Hello ,
My splunk query is simple:

 

index=abc,source=xxx.trc
| transaction host source max events=100000
| table _time host source _raw

 

Now when i execute this until transaction command, it is fine "<", ">" they appear as it is.

 

But when i give table command, "<", ">" changed to "&lt;" and "&gt;"

 

Is there anyway i can prevent this?

Labels (2)
Tags (3)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

As others weighed in, I cannot reproduce this, either.  Here is a test code according to your description:

index = _internal "<" sourcetype=splunkd
| transaction thread_id
| table _raw

Here, I'm including a transaction, followed by a table command.  Please see if you get any weird artifact.  For me, nothing unusual:

Screenshot 2025-05-20 at 7.53.41 AM.png

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

When you are modifying simple xml dashbords with GUI and you are mixing source and UI options that editor covert those values between < and &gt;

To avoid this you should use only source mode and even add <![CDATA[….]]> inside query tags. 

0 Karma

sarvesh_11
Communicator

this is happening, on search page. Not even created dashboard

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Can't reproduce.

| makeresults count=100
| eval _raw="2025-05-19 12:38:40 aaa <something> bbb <something else> let's make this event long. Or at least long-ish. reason=we'll see how it works <br> &lt;<how about <now>/>&rt; No change. Thisisfine...",host="a",source="b"
| transaction maxevents=10000 host source
| table _time host source _raw

Splunk 9.3.0. Works as it should.

0 Karma

sarvesh_11
Communicator

Yes, it is working for me, for other data sources. This one particularly creating problem.

So just wanted to know, what should i check?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

To be fully honest, I have no idea what's going on if this is indeed the only thing that's happening. Is this the output in the search app window? Or is it an output of some dashboard panel powered by the search you've provided?

Anyway, I'd start with checking if just listing raw events causes the same issue. If it does, add more and more commands one by one to see when the issue appears.

 

0 Karma

sarvesh_11
Communicator

this is on search app window, not created dashboard now. But accepting it would be the same behaviour

 

0 Karma

PickleRick
SplunkTrust
SplunkTrust

OK. This is very very strange. I've had logs with < and > signs many times over my years of Splunk experience and never noticed such behaviour.

It is possible that you're triggering some obscure bug so it's important to narrow down its scope (as I wrote earlier - try to pinpoint the exact moment when this issue appears - whether it's the transaction command, the table command after transaction or maybe it is happening with the table command without transaction as well). And it's most probably a support case material.

0 Karma

sarvesh_11
Communicator

But there are many fields inside _raw, so when i execute, table *, there is no problem with that. 

BUt when the whole data comes under _raw, those operator changes to xml values.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can't reproduce either - please share your dashboard/report search so we can see what else might be going on?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The table command doesn't of itself modify the contents of fields. How are you displaying the contents of the fields?

0 Karma

sarvesh_11
Communicator

I have exactly copied my splunk query. My final results are _time, host,source,_raw, there are no more fields in it, whole of the event is in _raw

sarvesh_11_0-1747644220469.png

 

sarvesh_11_1-1747644365760.png

 

The one highlighted in green is, when executed till transaction. The one in pink is with Table command.

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

If you search for only that first single event in that time

index=abc,source=xxx.trc GetDbfRecordFromCache

do nothing else, but then look at the _raw event in the display, are the characters encoded in the data or are then <>?

If you then open the event with the little arrow and select Show Source

bowesmana_0-1747697830257.png

 

what does the raw event data look like - is it encoded or not?

 

0 Karma

sarvesh_11
Communicator

No, it is not coded. Operators are there.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...