Splunk Search

removal of special character < question

hermeslxxv
Engager

Hello Everyone,
I am trying to format some syslog data for a dashboard output. I have no idea how to remove the < character within a search template. when I use replace in a search it works fine, but the template wont accept the string. ive also tried rex mode sed with no luck.

| replace "*< cr> ]" WITH "*" IN CmdSet
:note there is no space in front of the cr.

Any suggestions are appreciated!

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

If you're editing XML by hand, you need to replace < with &gt; or wrap the entire search string in <![CDATA[search string]]>. Else the opening angle bracket gets interpreted as the start of an XML tag.

If you're editing through the UI the replacement should happen automagically.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

If you're editing XML by hand, you need to replace < with &gt; or wrap the entire search string in <![CDATA[search string]]>. Else the opening angle bracket gets interpreted as the start of an XML tag.

If you're editing through the UI the replacement should happen automagically.

hermeslxxv
Engager

wrapping the entire string worked perfectly, thank you

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...