Dashboards & Visualizations

passing two tokens using simple xml

himynamesdave
Contributor

<drilldown>
<link>manual_search-verification?form.index="$index$"&field="$field$"</link>
</drilldown>

I am trying to pass two tokens using a drilldown on a table object.

Splunk will not let me pass two tokens using an & operator (see code) - I get an XML syntax error (says it is expecting [;]... not sure how to implement this)

How should I be writing this query?

Thanks for the help all!

Tags (1)
0 Karma
1 Solution

himynamesdave
Contributor

OK I've solved this myself, hope it helps someone else out too...

So instead of using "&" to join the query use "&amp;". For example:

<link>view?form.index="$index$"&amp;field="$field$"</link>

NOT:

<link>view?form.index="$index$"&field="$field$"</link>

View solution in original post

himynamesdave
Contributor

OK I've solved this myself, hope it helps someone else out too...

So instead of using "&" to join the query use "&amp;". For example:

<link>view?form.index="$index$"&amp;field="$field$"</link>

NOT:

<link>view?form.index="$index$"&field="$field$"</link>

marciniega
Explorer

Old post, but this helped me out. Thanks for checking back in!

0 Karma

lguinn2
Legend

You could also use CDATA to enclose text that you don't want to be processed as XML, like this

<link><![CDATA[view?form.index="$index$"&field="$field$"]]></link>
0 Karma

rroberts
Splunk Employee
Splunk Employee

CDATA block is the way to go I think. Much easier.

0 Karma

marciniega
Explorer

Also helpful, thank you!

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...