topic Re: Drilldown not working, even when using <![CDATA]]> in Splunk Search

Drilldown not working, even when using

UMDTERPS — Fri, 05 Mar 2021 21:22:22 GMT

I am having a similar issue to this thread here, but my drilldown search still won't work (explanation below):

https://community.splunk.com/t5/Dashboards-Visualizations/In-a-dashboard-why-can-t-I-configure-a-drill-down-with-a-rex/m-p/405348

I have a panel on my dashboard with a custom drilldown and search. The search works perfectly when running it as a search on it's own. However, in the search string we have a "rex" and those don't play nice with drilldowns and XML.

|rex field=field1 "^(?<field2>[^ ]+)"

Apparently, according to the thread above, you need to wrap the data in "<!CDATA[]]?>":

The drilldown will execute and open another tab, but the search stops at

rex field=field2 "^(

I get an error saying "Unbalanced quotes." The search runs on it's own, but not when using a custom drilldown search and wrapping the search in "CDATA."

Any ideas on how to get this search running with rex and no errors in a custom drilldown?

Thanks

Re: Drilldown not working, even when using

richgalloway — Fri, 05 Mar 2021 21:49:01 GMT

Try URL-encoding the drilldown target.

Re: Drilldown not working, even when using

UMDTERPS — Fri, 05 Mar 2021 22:11:12 GMT

https://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/OverviewofSimplifiedXML#Special_characters_in_XML_files

|rex field=field1 "^(?<field2>[^ ]+)" URL Encoded below: | rex field=field1 "^(?<field2>[^ ]+)"

I'm assuming this is what you mean?

When I run the the drilldown, I get:

Error in 'SearchParser': Missing a search command before '^'. Error at position '211' of search query '| inputlookup data.csv ...{snipped} {errorcontext = IG_ID>[^ ]+)"}'.

Re: Drilldown not working, even when using

richgalloway — Sat, 06 Mar 2021 01:17:25 GMT

The original drilldown was failing because the "?" character separates arguments in a URL. Including one in the search query effectively ending the query. The "?" needs to be encoded if nothing else.

Re: Drilldown not working, even when using

UMDTERPS — Wed, 17 Mar 2021 16:36:41 GMT

Yeah, I ended up replacing the "?" with "%3F" and the "+" with "%2B" in the "<link target="_blank">search?q=.....</link>" and it worked.

Seems like it's not listed here?:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/OverviewofSimplifiedXML

Thanks

Re: Drilldown not working, even when using

richgalloway — Tue, 09 Mar 2021 13:41:09 GMT

Submit feedback on that doc page letting them know of your experience. They'll likely change the page.

Re: Drilldown not working, even when using

UMDTERPS — Wed, 17 Mar 2021 16:41:09 GMT

Thanks, I submitted feedback on the page. 👍