I have recently upgraded my local version of Splunk Enterprise from 6.3.2 to 6.5.1 on my macbook pro running Mac OS 10.11.6 (15G1004). On doing so I noticed that I could no longer do any searches. It seemed to hang on 'parsing job'. The strange thing is that all the dashboards continued to work just fine, however when trying to run the search that populated the dashboard panel it gets stuck on 'parsing job'. I then tried 6.5.2 and got the same problem. I then reverted to 6.4.5 and it works fine. Is there some sort of incompatibility issue or did something get updated in 6.5 that is now affecting how the search works? ... View more

I am trying to count events where a field is in between a couple of ranges. My field is detail.id which has the following format -> A1234567B First thing I do is substring out the digits, then check if the digits are in certain ranges, and then count them. baseSearch | eval id=substr(detail.id,2,7) | eval ps_id = if((id >= 2700000 AND id <= 2,704,999) OR (id >= 2730000 AND id <= 2735999), 1, 0) | stats sum(ps_id) as count I am editing the source xml for a dashboard so when I try and save this, I get the following error: Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 77: StartTag: invalid element name This seems to be something with the < since when I take it out, I can save it, but the search, however, doesn't work. ... View more