Splunk Search

inputlookup in view with rex

EricPartington
Communicator

I have a csv file that tracks firewall rule hits. I would like to create a form that reads the csv and populates a drop down menu that allows the user to select a field extracted via rex which will populate a larger search from the same csv.
The rule_name field may have a 4 character (alpha numeric)identified that will define a group responsible for those rules. That is the field I want to show in the dropdown field.

here is the form code that I want to use, however splunk spits back an invalid XML message.
As far as i can tell the xml is valid (no broken tags), is it the rex command that causes the error?

<form>
  <label>Code Rule Search</label>
  <searchTemplate>| inputlookup pp-fw-rule-tracker appcode=$appcode$ | table rule_name,cluster | sort cluster desc</searchTemplate>

<fieldset>
   <input type="dropdown" token="appcode">
   <label>select appcode</label>
   <choice value="*">All</choice>
   <populatingSearch fieldForValue="appcode" fieldForLabel="appcode">| inputlookup pp-fw-rule-tracker |rex field=rule_name "(?<appcode>^[\"]{0,1}[a-zA-Z\d]{4})-" | dedup appcode |table appcode</populatingSearch>
  </input>
</fieldset>
<row>
  <table>
    <title>Rules matching Appcode from Tracker CSV</title>
  </table>
</row>
</form>

Ayn
Legend

Yes, or rather it is the tags in the rex command that is causing trouble. Since you're enclosing them in an XML document, they are interpreted as part of the XML data rather than as part of the rex command. To specify that these tags are not referring to the XML structure, use the special escaping sequence <![CDATA[ and its corresponding end sequence ]]>:

<form>
  <label>Code Rule Search</label>
  <searchTemplate>| inputlookup pp-fw-rule-tracker appcode=$appcode$ | table rule_name,cluster | sort cluster desc</searchTemplate>

<fieldset>
   <input type="dropdown" token="appcode">
   <label>select appcode</label>
   <choice value="*">All</choice>
   <populatingSearch fieldForValue="appcode" fieldForLabel="appcode"><![CDATA[| inputlookup pp-fw-rule-tracker |rex field=rule_name "(?<appcode>^[\"]{0,1}[a-zA-Z\d]{4})-" | dedup appcode |table appcode]]></populatingSearch>
  </input>
</fieldset>
<row>
  <table>
    <title>Rules matching Appcode from Tracker CSV</title>
  </table>
</row>
</form>
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...