topic Re: Custom drilldown search not working in Splunk Search

Custom drilldown search not working

tmontney — Thu, 22 Feb 2018 22:49:54 GMT

On a dashboard I have a panel with the following search:

index="perfmon" counter="% Processor Time" host!="HOST1*" host!="HOST2" host!="HOST3"
| bucket _time span=35m
| stats avg(Value) AS AVERAGE count(Value) AS INSTANCES by host
| where AVERAGE > 25
| where INSTANCES >= 2
| eval Occurances=Round(INSTANCES/2,0)
| table host Occurances
| head 10
| sort Occurances
| reverse

I just discovered drilldowns, so I set it to Link to Search (Custom) new tab.

index="perfmon" counter="% Processor Time" host="$click.value2$"

I click the left most column (host), and it all I see is "Loading...". I inspect Chrome's console and I see "malformed Uri" error. Comparing the URL to that of a normal search and it seems a bit off.

https://MYSPLKSERVER/en-US/app/MYAPP/search?q=index=%22perfmon%22%20counter=%22%%20Processor%20Time%22%20host=%22mypchere%22&earliest=-24h@h&latest=now

vs a regular search

https://MYSPLKSERVER/en-US/app/MYAPP/search?q=search%20index%3D%22perfmon%22%20counter%3D%22%25%20Processor%20Time%22%20host%3Dmypchere&sid=12345.67890&display.page.search.mode=verbose&dispatch.sample_ratio=1&earliest=-24h%40h&latest=now

I think it's missing q=search and is not encoding the URL properly (equal signs specifically). My version is 7.0 for the server.

I've resorted to just using a URL (to create the search manually), but that's really not ideal.

Re: Custom drilldown search not working

jeffland — Fri, 23 Feb 2018 10:24:10 GMT

It seems that splunk does not url-encode the % character on drilldown. That looks like a bug, a quick fix is to do it yourself. Edit the Simple XML of your dashboard (Edit - Source) and find the line where it says

<drilldown>
  <link target="_blank">search?q=index="perfmon" counter="% Processor Time" host="$click.value2$"</link>
</drilldown>

Change the percent sign to its url encoded value %25 like this:

<drilldown>
  <link target="_blank">search?q=index="perfmon" counter="%25 Processor Time" host="$click.value2$"</link>
</drilldown>

And it should work as expected.

Re: Custom drilldown search not working

nickdewijer — Tue, 13 Nov 2018 08:06:14 GMT

I'm experiencing the same problem with having upgraded to 7.2.1 (newest version of splunk as of this writing)

Re: Custom drilldown search not working

jeffland — Tue, 13 Nov 2018 12:00:22 GMT

If you have a support entitlement, you could file a bug report.

Re: Custom drilldown search not working

niketn — Tue, 13 Nov 2018 13:50:23 GMT

Try the following which has URL Encoding for Quotes, Spaces and Percent:

<drilldown>
  <link target="_blank">search?q=index=%22perfmon%22%20counter=%22%2525%20Processor%20Time%22%20host=%22$click.value2$%22&amp;earliest=-24h@h&amp;latest=now</link>
</drilldown>

Moreover, if you are on Splunk Enterprise 6.6 or higher you do not need to code Drilldown, this feature is available through UI Edit itself. Which implies if you create a drilldown link to search via UI, you do not have to worry about URL Encoding as Splunk will do it for you. Please try out and confirm.

Re: Custom drilldown search not working

jeffland — Wed, 14 Nov 2018 10:20:08 GMT

IIRC, quotes and spaces are encoded correctly on drilldown regardless of what you set in Simple XML - only percent isn't. I don't know whether using the UI editor makes a difference (if it encodes the url on writing it to Simple XML, it could make a difference - otherwise it shouldn't).

Re: Custom drilldown search not working

davebo1896 — Thu, 17 Jan 2019 22:31:08 GMT

%2525 in simplexml is a workaround (as of 7.2.3)
You can also replace % with %25 in the UI editing view

Re: Custom drilldown search not working

davidcaccia — Thu, 24 Jan 2019 19:34:25 GMT

I ran into this issue in the UI for Splunk 7.0.0 and had to manual perform the URL encoding, as recommended here... that is, when adding a search string to the panel to define a custom drill-down action (Is there another path that obviates the need to perform manual URL encoding?)

Re: Custom drilldown search not working

davebo1896 — Mon, 28 Jan 2019 20:25:15 GMT

SPL-163158 is the bug number