Is drilldown supported in IE 6?

[wang]

Does drilldown work with IE 6? I have a lot of trouble with drill down in IE which does not happen in FF. Problems include no matching event (when FF found them) and can't do show source when an event is found.

I’ve capture the URLs in this example. IE returns nothing when FF found 1 event.

Event: 2011-04-05 16:30:34,971 WARN [status.driver:ajp-0.0.0.0-8009-92] - filer=***5284 authCode= year=2009 app=null test=false. Using 'NA' for authCode

Splunk Query: index=myindex host="myhost*" " WARN [" | rex "(?i)[\d\s\w]+\[(?P[^\]:]+)" | search LOG_SOURCE="status.driver"

IE: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20%5B%22%20%7C%20rex%20%22(%3Fi)%5B%5C%5Cd%5C%5Cs%5C%5Cw%5D%2B%5C%5C%5B(%3FP%3CLOG_SOURCE%3E%5B%5E%5C%5C%5D%3A%5D%2B)%22%20%7C%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433

Firefox: https://mySplunkServer/en-US/app/search/flashtimeline?q=search%20index%3Dmyindex%20host%3D%22myhost*%22%20%22%20WARN%20%20[%22%20|%20rex%20%22%28%3Fi%29[\d\s\w]%2B\[%28%3FP%3CLOG_SOURCE%3E[^\]%3A]%2B%29%22%20|%20search%20LOG_SOURCE%3D%22status.driver%22&earliest=1302045780&latest=1302049433

[sideview]

Drilldown is definitely supported in IE6. I just investigated a little bit and it's very strange that the permalink URL you list for IE is different than the link you list for Firefox.

The URL you list for IE seems to not work in either Firefox OR IE - it ends up loading a search in the search field where backslashes are not escaped as double backslashes.

Whereas the URL you list for firefox seems to run correctly in both Firefox and IE.

(Splunk has an unfortunate convention where any backslashes present in the search field have to doubled by the user when they type into the search field.)

I would write up how you got the bad URL in IE and send it into support@splunk.com