Splunk Search

setup.xml custom endpoint label newline

klee310
Communicator

I'm trying to put a newline in my label tag in for one of the inputs. Not sure how the newline character should be specified.

This is what I have:

<input field="general_log_encoding_string">
 <label>
 Custom character-encoding name if different from default, ex. BIG-5
 \n\r
 See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details</label>
 <type>text</type>
</input>

But the result comes out like this:

Custom character-encoding name if different from default, ex. BIG-5 \n\r See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details

Any help is greatly appreciated. Thanks

0 Karma

klee310
Communicator

I've checked everywhere, and there doesn't seem to be a solution anywhere. I guess I'll just give up this function. Its bells-and-whistles anyways.

0 Karma

LukeMurphey
Champion

You can do this using a break or paragraph tag. However, you will need to put your HTML in CDATA blocks so that it is ignored by Splunk's XML parser. Below is an updated version of your sample:

<input field="general_log_encoding_string">
 <text>
 Custom character-encoding name if different from default, ex. BIG-5
 <![CDATA[<p>]]> <!-- Note the custom HTML included here -->
 See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details</text>
 <type>text</type>
</input>
0 Karma

LukeMurphey
Champion

Check the internal error log. Open the search app and run a search for:

index=_internal error

0 Karma

klee310
Communicator

not quite sure what you're trying to get at. if I replace the label tag with the text tag, the setup.xml screen doesn't even load up. AttributeError: 'NoneType' object has no attribute 'text'

0 Karma

LukeMurphey
Champion

Try putting the comment in in a text tag as opposed to a label tag. i.e. ...

0 Karma

klee310
Communicator

tried that, and this is what i get:
Custom character-encoding name if different from default, ex. BIG-5

See http://www.splunk.com/base/Documentation/4.2/Data/Configurecharactersetencoding for details

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...