I have a table on my simple XML dashboard which is driven by a fairly simple pivot command. If I click on it the drilldown takes me to the search view, with a 17,000 character search string. This is because the search string that Splunk specifies evals and then renames every attribute in the underlying data model.
This results in a query string which is a) completely unworkable and b) doesn't work at all in IE which truncates the URL at 2083 characters.
Seems like a bug to me! Surely the drilldown need to either make use of the Pivot command, or at least only evaluate the fields in the data model that are necessary for the query...
The only workaround I know of is to define custom drilldown links for every chart / table in my dashboards. But all of my dashboards have a selection of dropdown input fields which specify e.g. FILTER conditions for the Pivot commands, and all of these have to then be manually passed through on the drilldown links -- which is a) tedious, and b) hard to maintain. Does anyone know of a better way?
