Drilldown Search

[balcv]

I have a search table that lists user ids in the form of [domain][userid] and a numeric value. There is a drilldown set on the user id that opens a new search where the user id becomes the search value. The problem is that when the new search opens I have to manually replace the single '\' with '\' so the search will run.

Drilldown search looks like this:

index="pan" user="$row.user$" | stats count by http_category | sort -count  

Where $row.user$ is the carried forward value (eg uni\3333333) and is what I have to manually correct to uni\3333333.

Is there a way that I can have this manual correction made automatically as part of the drilldown search string.

Cheers

[whrg · Accepted solution]

Hello @balcv,

I suppose your drilldown looks like this:

<table>
   <search>
      ...
   </search>
   <drilldown>
      <link target="_blank">search?q=index=pan%20user=%22$row.user$%22</link>
   </drilldown>

You can use eval expressions in drilldowns. Here is a similar question: How do you use eval in XML drilldown?

So this should work:

<drilldown>
   <eval token="usertoken">replace($row.user$,"\\\\","\\\\")</eval>
   <link target="_blank">search?q=index=pan%20user=%22$usertoken$%22</link>
</drilldown>

The additional backslashes in the replace function are required for escaping the actual backslashes.

[balcv]

Perfect. Thank you. I did have to make one alteration to the code you provided and that was replace the %22 and %20 with the actual characters, but other than that, this is exactly what I needed.