Dashboards & Visualizations
Highlighted

Drilldown from Pivot driven table leads to search string with 17,000 characters and breaks Internet Explorer

Path Finder

I have a table on my simple XML dashboard which is driven by a fairly simple pivot command. If I click on it the drilldown takes me to the search view, with a 17,000 character search string. This is because the search string that Splunk specifies evals and then renames every attribute in the underlying data model.

This results in a query string which is a) completely unworkable and b) doesn't work at all in IE which truncates the URL at 2083 characters.

Seems like a bug to me! Surely the drilldown need to either make use of the Pivot command, or at least only evaluate the fields in the data model that are necessary for the query...

The only workaround I know of is to define custom drilldown links for every chart / table in my dashboards. But all of my dashboards have a selection of dropdown input fields which specify e.g. FILTER conditions for the Pivot commands, and all of these have to then be manually passed through on the drilldown links -- which is a) tedious, and b) hard to maintain. Does anyone know of a better way?

Tags (4)
0 Karma
Highlighted

Re: Drilldown from Pivot driven table leads to search string with 17,000 characters and breaks Internet Explorer

Contributor

If u want to disable the drill down in search results.
Hope its a " table format" u have a option drill down=None

This option is inbetween the time bar and results table.

0 Karma
Highlighted

Re: Drilldown from Pivot driven table leads to search string with 17,000 characters and breaks Internet Explorer

Path Finder

Yes, thank you, I'm aware that I could just disable drilldown (and indeed I've done that as a temporary workaround). But drilldown is such a valuable feature that I really want it to work...

0 Karma