Use query $foo$ in html module : error with whitespace

[sbsbb]

I have a search module, after that module I want an html module with to links :
- one link pointing to flashtimeline/?q=| loadjob $searchid$
- one link pointing to the search itself : flashtimeline/?q=$search$

Ergebnisse
Suche

It seems that the link is not working on the target splunk page, because of the whitespace, I've tried with several combination : normal space in the code, substitution whitespace string... but nothing is working ? Any Idea what I make wrong ?

[sideview · Accepted solution]

I'm not sure what's wrong specifically but I suspect it has more to do with characters in your searchstring like double quotes, rather than whitespace anywhere.

Here is the rundown of how to put links into your view:

1) In very simple use cases where you know your search string(s) will never have problematic characters, you can just do this:

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In particular the $results.sid$ token will never have bad chars, so that one should work always. The $search$ one... that one may very well have characters that would need to be url encoded or the link's HTML can be malformed, or the resulting URL incorrect.

So....

2) As long as you have Sideview Utils 2.5 or newer (latest as of this writing is 2.6.3), then you can put a urlEncodeKeys param directly on the HTML module to take care of those characters. The following will work even for very complex searches. Note that I have also passed the timerange arguments .

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
  <param name="urlEncodeKeys">search</param>
</module>

3) If you have an older copy of Sideview Utils than 2.5, back in the day you had to use a ValueSetter module and its 'urlEncodeKeys' param:

<module name="ValueSetter">
  <param name="name">encodedURL</param>
  <param name="value">flashtimeline?q=$search$&amp;earliest=$search.timeRange.earliest$&amp;latest=$search.timeRange.latest$</param>
  <param name="urlEncodeKeys">search</param>

  <module name="HTML">
    <param name="html"><![CDATA[
      <a href="$encodedURL$">run the search again in Splunk's default search page</a>
    ]]></param>
  </module>
</module>

This was such a common use case that eventually I went back and gave HTML its own urlEncodeKeys param.

Hope that helps.

remember to stay up to date - http://sideviewapps.com/apps/sideview-utils

and there's a mailing list these days so you can get a little email whenever there's a new release. http://sideviewapps.com/apps/sideview-utils/mailing-list/

[sbsbb]

Thanks, I had really some problems with white space, with my link above, by opening the result URL, I had an error message, that the sid is not found, if I delete the space, and make a new one, its working... strange !
I've now made a copy paste from your link, and its working.
I've not understood everything there, but thanks, it works !