topic Re: Simple XML drilldown link search won't recognize regex or rex in Splunk Search

Simple XML drilldown link search won't recognize regex or rex

flegel2 — Wed, 15 Jun 2016 14:16:44 GMT

I have a dashboard panel with a table. I am able to change the drilldown search when selecting a row in the panel table to open a new window with the new search:

        <search>
          <query>index=$Environment$ ( program=*shot_director OR program=cryo_director* ) shot_Id=$shotIdPattern$ "Commanded|GoToState" | sort _time | table _time,program,shot_Id,slc_State</query>
          <earliest>$shotEarliest$</earliest>
        </search>
        <drilldown>
          <link target="_blank">
            /app/search/search?q=search index=$Environment$ "&lt;macro_step_complete&gt;" "Execution of Macro Step " shot_id=$shotIdPattern$ | eval subsystem=shot_supervisor | sort -_time 
          </link>
        </drilldown>

but when I add the regex

| rex field=taxon (?<ss>[^|]*)[|]

creating

            /app/search/search?q=search index=$Environment$ "&lt;macro_step_complete&gt;" "Execution of Macro Step " shot_id=$shotIdPattern$ | rex field=taxon (?&lt;ss&gt;[^|]*)[|] | eval subsystem=shot_supervisor | sort -_time

the search window created results in:

index=iccs_int "<macro_step_complete>" "Execution of Macro Step " shot_id=N160613-003* | rex field=taxon (

in the search box and the error

Error in 'rex' command: Encountered the following error while compiling the regex '(': Regex: missing )

It seems the "?" in the regex is being consumed before it is being sent to the search app.

Any ideas?

Thanks in advance!

Re: Simple XML drilldown link search won't recognize regex or rex

sundareshr — Wed, 15 Jun 2016 14:34:16 GMT

Try using CDATA, like this

<link>
<![CDATA[
  /app/search/search?q=search index=$Environment$ "<macro_step_complete>" "Execution of Macro Step " shot_id=$shotIdPattern$ | rex field=taxon (?<ss>[^|]*)[|] | eval subsystem=shot_supervisor | sort -_time 
]]>
</link>

Re: Simple XML drilldown link search won't recognize regex or rex

woodcock — Wed, 15 Jun 2016 15:04:19 GMT

The rex string needs to be in double-quotes like this:

 | rex field=taxon "(?<ss>[^|]*)[|]"

Re: Simple XML drilldown link search won't recognize regex or rex

flegel2 — Wed, 15 Jun 2016 15:07:19 GMT

Using CDATA has no effect on the results.

Re: Simple XML drilldown link search won't recognize regex or rex

flegel2 — Wed, 15 Jun 2016 15:07:36 GMT

The quotes has no effect on the results.

Re: Simple XML drilldown link search won't recognize regex or rex

vsingla1 — Fri, 10 Mar 2017 17:53:31 GMT

@flegel2 I fixed it by placing the ASCII value of ? in the query. Its ASCII value is %3F

Re: Simple XML drilldown link search won't recognize regex or rex

manikyasandeepg — Thu, 21 Jun 2018 18:25:57 GMT

Is it working for you now? I have the same issue.

Re: Simple XML drilldown link search won't recognize regex or rex

rrovers — Fri, 20 Jul 2018 09:13:30 GMT

if you save your search as a 'saved search' and call the drilldown as a link target in your dashboard the rex should work.
so:
dashboard:
search?q=|savedsearch [name of savedsearch]
If you've used arguments in your saved search you should als use them in the link of course.
Saved search:
Here you can use the rex syntax as usualy.

Re: Simple XML drilldown link search won't recognize regex or rex

wilsonite — Tue, 11 Sep 2018 15:04:01 GMT

Every "?" in the search string must be replaced with %3F. The only exception is if you are editing .XML dashboard. In which, you will replace all except for the first one at the beginning of the link section.

<link target="_blank">search?q=

All other ?s must be changed to %3F whether in the extraction, or when escaped out in matching text.

Re: Simple XML drilldown link search won't recognize regex or rex

wilsonite — Tue, 11 Sep 2018 15:09:40 GMT

This solution works correctly as well.