Dashboards & Visualizations

passing two tokens using simple xml

himynamesdave
Contributor

<drilldown>
<link>manual_search-verification?form.index="$index$"&field="$field$"</link>
</drilldown>

I am trying to pass two tokens using a drilldown on a table object.

Splunk will not let me pass two tokens using an & operator (see code) - I get an XML syntax error (says it is expecting [;]... not sure how to implement this)

How should I be writing this query?

Thanks for the help all!

Tags (1)
0 Karma
1 Solution

himynamesdave
Contributor

OK I've solved this myself, hope it helps someone else out too...

So instead of using "&" to join the query use "&amp;". For example:

<link>view?form.index="$index$"&amp;field="$field$"</link>

NOT:

<link>view?form.index="$index$"&field="$field$"</link>

View solution in original post

himynamesdave
Contributor

OK I've solved this myself, hope it helps someone else out too...

So instead of using "&" to join the query use "&amp;". For example:

<link>view?form.index="$index$"&amp;field="$field$"</link>

NOT:

<link>view?form.index="$index$"&field="$field$"</link>

marciniega
Explorer

Old post, but this helped me out. Thanks for checking back in!

0 Karma

lguinn2
Legend

You could also use CDATA to enclose text that you don't want to be processed as XML, like this

<link><![CDATA[view?form.index="$index$"&field="$field$"]]></link>
0 Karma

rroberts
Splunk Employee
Splunk Employee

CDATA block is the way to go I think. Much easier.

0 Karma

marciniega
Explorer

Also helpful, thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...