topic Re: Passing 2 values Drilldown in Splunk Search

Passing 2 values Drilldown

behymejt2012 — Tue, 23 Apr 2013 14:01:41 GMT

Hi Everyone,

While using Simple XML, I am able to easily pass a value from a table row or from an actual form. The problem I have is when I try and pass 2 values through the drill down link, here is what I am trying to do:

www.example.com?row.Type=$click.value$ form.example1=$form.example1$

The values pass through to the new form, but its all combined together and cannot collect the unique values. I am not sure if I need to add an & symbol between the two values to properly separate them.

Re: Passing 2 values Drilldown

LukeMurphey — Tue, 23 Apr 2013 15:37:36 GMT

I think you may just missing an amperstand between $click.value$ and form.example1:

<link>www.example.com?row.Type=$click.value$&amp;form.example1=$form.example1$</link>

Make sure to use the XML entity for the amperstand (and other enitities) or use a CDATA block:

<link><![CDATA[www.example.com?row.Type=$click.value$&form.example1=$form.example1$]]></link>

Re: Passing 2 values Drilldown

behymejt2012 — Tue, 23 Apr 2013 18:24:56 GMT

Thanks for the response, the problem is that you cannot add an amperstand in the xml. It throws the following error:

"Encountered the following error while trying to update: In handler 'views': Error parsing XML on line 27: xmlParseEntityRef: no name"

Re: Passing 2 values Drilldown

LukeMurphey — Tue, 23 Apr 2013 18:27:47 GMT

Try using the entity name: http://www.w3schools.com/tags/ref_entities.asp

I'll update the answer accordingly.