Splunk Search

search fails in xml file

DTERM
Contributor

The following search works fine in the Splunk search:

index=mydata | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

When I take that same search and place it in an xml file like:

  <searchTemplate>

index=dns | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

It fails. (That search in the XML starts and ends with the searchTemplate tags although I don't see those in this post, though they are there.) I get the following error when trying to start Splunk:

Checking configuration... Error while parsing '/opt/splunk/etc/apps/myApp/default/data/ui/views/source.xml':

mismatched tag: line 6, column 4

I don't see the mismatched tag. What is the problem with the XML?

Thanks.

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

The problem with your search is the ">" and "<". The angel brackets are treated as part of XML tags. Replace those with the HTML entities & lt; and & gt; . Hope that fixes your problem.

View solution in original post

bmacias84
Champion

The problem with your search is the ">" and "<". The angel brackets are treated as part of XML tags. Replace those with the HTML entities & lt; and & gt; . Hope that fixes your problem.

DTERM
Contributor

Based on this response, I've created the following search:

index=data | rex "\s+IP\s+(?<src_ip> \d+.\d+.\d+.\d+).(?<src_port>\S+)\s+>\s+(?<dest_ip>\d+.\d+.\d+.\d+).(?<dest_port>[a-z0-9]+):\s+" | top src_ip

This still fails in the XML file. Is there anything within Splunk that helps resolve such regular expressions? Why does this not work? What is incorrect?

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...