topic Re: Prevent " in Drilldown Onclick in Splunk Search

Prevent " in Drilldown Onclick

jokovitch — Sun, 08 Aug 2021 12:23:41 GMT

I have Drilldown that show me some Test and this is Onclick:

index=main |where Test="$click.value$"

The problem is when $click.value$ contains Double quote (")

And then I got an error in Search screen "Unbalanced quotes"

How to fix it ?

Re: Prevent " in Drilldown Onclick

kamlesh_vaghela — Sun, 08 Aug 2021 13:01:04 GMT

@jokovitch

Try this in drilldown search,

$click.value|s$

https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters

Re: Prevent " in Drilldown Onclick

jokovitch — Mon, 09 Aug 2021 04:23:15 GMT

That didn't help.

Because it's add " in the beginning and in the end of Test . so now it's open the search Windows with this query

index="main"|where Test=""Dog""

So i got an error : Error in where command: the operator at Dog"" is invalid

Re: Prevent " in Drilldown Onclick

kamlesh_vaghela — Mon, 09 Aug 2021 04:43:43 GMT

@jokovitch

Can you please try this?

<dashboard> <label>Prevent " in Drilldown Onclick</label> <row> <panel> <title>$val$</title> <table> <search> <query>| makeresults | eval test="\"Dog\"" | table test</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="drilldown">row</option> <drilldown> <eval token="val">replace($click.value$,"\"","\\\"")</eval> <link target="_blank">search?q=| makeresults | eval test="$val$"&earliest=-24h@h&latest=now</link> </drilldown> </table> </panel> </row> </dashboard>

Please check drilldown logic.