I configured a drilldown through the GUI. The search is something like this:
index=* "message.Origin"=TEST
source="/opt/mulesoft/logs/something.log"
OR source="/opt/mulesoft/logs/somethingelse.log"
OR source="D:\\Log\\anything.json"
| stats values(a.b) AS ab ,values(c.d) as cd count(eval('logger' ="nl.logger,answers")) as "Start ",count(eval(logger ="n.questions. HTTP status: 200.")) as "questions" by message.MessageId,
| where ‘questions’ <1
when i click the panel to drilldown chrome opens a blank page and nothing else happens. When I look in the source I see this:
<drilldown>
<link target="_blank">search?q=index=*%20%22message.Origin%22=TEST%20source=%22/opt/mulesoft/logs/ something.log %22%20OR%20source=%22/opt/mulesoft/logs/ somethingelse.log %22%20OR%20source=%22D:%5C%5CLog%5C%5Canything.json %22%20%0A%7C%20stats%20%20values(a.b)%20AS%ab%20,values(c.d)%20as%20cd%20count(eval('logger'%20=%22 nl.logger,answers........... ( etc etc etc)
I anomised the search due to security reasons, in IE the drilldown works just fine, also other drilldowns work in Chrome. I dont understand what is going wrong
the "<" charachter need to be encoded:
https://answers.splunk.com/answers/690132/in-a-dashboard-why-cant-i-configure-a-drill-down-w-1.html
Thanks, but I dont see how to encode something
try:
where ‘questions’ %3C 1
I fixed it by replacing '| where ‘questions’ <1' with '| where ‘questions’ =0'
Dont know why it didnt'work but now it does
Hi Mike, press F12 to open chrome debugger panel and then F5 to reload the the tab, then check "console" and "network" tabs in the debugger panel - do you see any warnings or errors?
Hi @PavelP ,
In console I get this when I open the dashoboard, in the tab which opens by the drilldown I dont get anything
common.js:1103 [Deprecation] document.registerElement is deprecated and will be removed in M80, around February 2020. Please use window.customElements.define instead. See https://www.chromestatus.com/features/4642138092470272 and https://developers.google.com/web/updates/2019/07/web-components-time-to-upgrade for more details.
which splunk and chrome version do you have?
@PavelP I fixed it by replacing '| where ‘questions’ <1' with '| where ‘questions’ =0'
Dont know why it didnt'work but now it does