Hi,
So I'm inheriting some splunk code that I'm going through and cleaning up. It contains:
rex field=source "/data/splunk/(?<key>.*)/"
The search runs fine, when I navigate to it in the browser, (bread crumbs: splunk > manager >> Searches and reports >> [the search name] ) and modify a completely unrelated part of the search and go to save it it kicks the error
Your entry was not saved. The following error was reported: SyntaxError: Unexpected token <.
I'm fairly sure it's not escaping <> inside of quotes properly, so I can't save my search. I can however create a new search that has the exact same text in it.
Thanks,
Tristan
This is a bug in all of the latest versions of Splunk and I do not know what causes it. I do not have an entitlement to open a case on it but hopefully you do so please DO open a case. You can tell that this is a bug because you will get the same error even if you change NOTHING and just try to resave your search.
I have a workaround: Copy down the details of the Search and save it fresh. It will ALWAYS save OK, but, it will NEVER be re-editable.
You are THE MAN!
Actually, @the_wolverine is THE LADY! 🙂
I should have guessed by the fingernails but the beard threw me off!
I'm also seeing several reports of this issue and in reviewing the query I see nothing wrong with it nor anything that was set unexpectedly.
Hi,
See (end of the article)
http://www.w3schools.com/xml/xml_syntax.asp
Replace special characters by xml entities:
< by <
> by >
& by &
And so on.
This is not the problem; this is a bug. See my answer.
whats the full search string?
Hello, I am having the same issue. Did you solve it?
Thanks.