I am using the snowincident command to set the "Splunk Drilldown" button in a ticket to a specific Splunk search. The url I'm passing to snow is encoded and it works well except that the %0A characters seem to get stripped out. This is a NewLine code, and so when the analyst clicks on the button and the search opens in Splunk, the info is all there but the formatting is messed up.
I'm not sure where it loses the %0A, but it's definitely in the string that I'm sending to snow. Has anyone else noticed this and is there a fix?
Thanks for the suggestion. Unfortunately I get the same result. Now, the %250A is stripped out of the url.