All Apps and Add-ons

Use query $foo$ in html module : error with whitespace

sbsbb
Builder

I have a search module, after that module I want an html module with to links :
- one link pointing to flashtimeline/?q=| loadjob $searchid$
- one link pointing to the search itself : flashtimeline/?q=$search$

Ergebnisse
Suche

It seems that the link is not working on the target splunk page, because of the whitespace, I've tried with several combination : normal space in the code, substitution whitespace string... but nothing is working ? Any Idea what I make wrong ?

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

I'm not sure what's wrong specifically but I suspect it has more to do with characters in your searchstring like double quotes, rather than whitespace anywhere.

Here is the rundown of how to put links into your view:

1) In very simple use cases where you know your search string(s) will never have problematic characters, you can just do this:

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In particular the $results.sid$ token will never have bad chars, so that one should work always. The $search$ one... that one may very well have characters that would need to be url encoded or the link's HTML can be malformed, or the resulting URL incorrect.

So....

2) As long as you have Sideview Utils 2.5 or newer (latest as of this writing is 2.6.3), then you can put a urlEncodeKeys param directly on the HTML module to take care of those characters. The following will work even for very complex searches. Note that I have also passed the timerange arguments .

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
  <param name="urlEncodeKeys">search</param>
</module>

3) If you have an older copy of Sideview Utils than 2.5, back in the day you had to use a ValueSetter module and its 'urlEncodeKeys' param:

<module name="ValueSetter">
  <param name="name">encodedURL</param>
  <param name="value">flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>
  <param name="urlEncodeKeys">search</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      <a href="$encodedURL$">run the search again in Splunk's default search page</a>
    ]]></param>
  </module>
</module>

This was such a common use case that eventually I went back and gave HTML its own urlEncodeKeys param.

Hope that helps.

remember to stay up to date - http://sideviewapps.com/apps/sideview-utils

and there's a mailing list these days so you can get a little email whenever there's a new release. http://sideviewapps.com/apps/sideview-utils/mailing-list/

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

I'm not sure what's wrong specifically but I suspect it has more to do with characters in your searchstring like double quotes, rather than whitespace anywhere.

Here is the rundown of how to put links into your view:

1) In very simple use cases where you know your search string(s) will never have problematic characters, you can just do this:

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In particular the $results.sid$ token will never have bad chars, so that one should work always. The $search$ one... that one may very well have characters that would need to be url encoded or the link's HTML can be malformed, or the resulting URL incorrect.

So....

2) As long as you have Sideview Utils 2.5 or newer (latest as of this writing is 2.6.3), then you can put a urlEncodeKeys param directly on the HTML module to take care of those characters. The following will work even for very complex searches. Note that I have also passed the timerange arguments .

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
  <param name="urlEncodeKeys">search</param>
</module>

3) If you have an older copy of Sideview Utils than 2.5, back in the day you had to use a ValueSetter module and its 'urlEncodeKeys' param:

<module name="ValueSetter">
  <param name="name">encodedURL</param>
  <param name="value">flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>
  <param name="urlEncodeKeys">search</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      <a href="$encodedURL$">run the search again in Splunk's default search page</a>
    ]]></param>
  </module>
</module>

This was such a common use case that eventually I went back and gave HTML its own urlEncodeKeys param.

Hope that helps.

remember to stay up to date - http://sideviewapps.com/apps/sideview-utils

and there's a mailing list these days so you can get a little email whenever there's a new release. http://sideviewapps.com/apps/sideview-utils/mailing-list/

0 Karma

sbsbb
Builder

Thanks, I had really some problems with white space, with my link above, by opening the result URL, I had an error message, that the sid is not found, if I delete the space, and make a new one, its working... strange !
I've now made a copy paste from your link, and its working.
I've not understood everything there, but thanks, it works !

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...