Some characters have special meaning in Simple XML files. To prevent the source code parser from treating them as special characters, wrap them in tags. But I think for URL encoding you have to handle this character. http://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/OverviewofSimplifiedXML#Special_characters_in_XML_files ... View more

This works! On the 2nd line, can you fix the capitalization typo by changing EventCODE=1502 to EventCode=1502? Thanks! ... View more