simple xml drilldown evaluated token value isn't passed into a link url string

[dperrands]

Hi, i've been trying to fix  this for the last 4 hours.  I'm evaluating a value in a drilldown.  

The evaluated value isn't literally being passed into the link token value i've specified.  Instead the token name is being passed into the link. 

I've looked through the docs and similar issues in this forum but nothing explains the problem i'm having.  I'm on Splunk Version 6.2.5 Splunk  Build 272645

Simple xml below

Any help would be amazing.

        <drilldown target="blank">
          <eval token="trunc_host">rex field=host mode=sed "s/\d+/"*"/g"|</eval>

          <link>

		<![CDATA[
          Integration_PRA_capacity_breakdown?form.host=$trunc_host$&form.stack=$row.stack$&earliest=-h$&latest=now
         ]]>
            
          </link>
        </drilldown>

This is the url generated

https://url/app/excd/Int_PR_city_break?form.host=%24trunc_host%24&form.stack=inst&earliest=-h%24&lat...

[richgalloway]

I looks like there's an extra $ in the link (after "earliest=-h") that may cause other problems.

I believe the eval is not populating the trunc_host token because the rex command does not return a value to assign to it.  Try using the replace function, instead.

<eval token="trunc_host">replace(host, "\d+","*")</eval>

[dperrands]

Thanks for taking the time to have a look.

I removed the extra $.

Although my original eval query returns a value when i perform the search separately i tried yours.  It seems a more elegant solution too.  

Unfortunately the same erroneous url is generated. 

form.host=%24trunc_host%24&form.stack=inst&earliest=-h&latest=now

Any other ideas?

[LHAYNES020]

I had the same problem and just came to a solution that may not be the most efficient, but is at least working for me.

I set the field value in the query itself and then had the search set a token on completion instead of in the drilldown. That seems to be correctly passing the value instead of the name.

      <table>
        <title>Google Test</title>
        <search>
          <done>
            <set token="link">$result.link$</set>
          </done>
          <query>|makeresults| eval link="google"|table *</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <option name="refresh.display">progressbar</option>
        <drilldown>
          <link target="_blank">https://$link$.com</link>
        </drilldown>
      </table>

[dperrands]

Thanks for this response.  I need to evaluate the value I’m trying to pass to the token.  I can’t seem to do this with the set token attribute. ☹️

[LHAYNES020 · Accepted solution]

Are you able to evaluate the value in the query like my example above? Perhaps if you can show what the rest of the panel looks like, we can find a place to set it that isn't in the drilldown itself.

[dperrands]

Thanks for your help here, it works!