removal of special character < question

[hermeslxxv]

Hello Everyone,
I am trying to format some syslog data for a dashboard output. I have no idea how to remove the < character within a search template. when I use replace in a search it works fine, but the template wont accept the string. ive also tried rex mode sed with no luck.

| replace "*< cr> ]" WITH "*" IN CmdSet
:note there is no space in front of the cr.

Any suggestions are appreciated!

[martin_mueller · Accepted solution]

If you're editing XML by hand, you need to replace < with > or wrap the entire search string in <![CDATA[search string]]>. Else the opening angle bracket gets interpreted as the start of an XML tag.

If you're editing through the UI the replacement should happen automagically.

[hermeslxxv]

wrapping the entire string worked perfectly, thank you