Escape < and > in the xml of dashboards

Question

Hi

I got the following error when I tried to save a dashboard after editing its xml:

Encountered the following error while trying to update: In handler 'views': Not valid XML: <view template="dashboard.html....

< and > characters are part of my search String because I'm using the rex search command

..
<module name="HiddenSearch" autoRun="True">
  <param name="search">| savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason</param>
..
.

How do those characters have to be escaped?

Accepted Answer

There are two ways:

Use < for < and > for >. You should also use & for any & and some people like to use " for ".
Enclose the entire search string in a CDATA tag: `(?.)" | stats count ]]>'

I personally think that it's a lot clearer to just use CDATA so your search query is readable:

 <module name="HiddenSearch" autoRun="True">
    <param name="search"><![CDATA[
      | savedsearch "Mysearch" | where isnotnull(Resource) | rex "r> (\[.*\] )*(?<Reason>.*)$" | fields host,hostname,Resource,Reason
    ]]></param>
    ...
 ...
 ...

Escape < and > in the xml of dashboards

Follow this question

Splunk Resources

Related questions