Update: I found this question https://answers.splunk.com/answers/610037/my-search-string-is-truncated-after-a-question-mar.html that correctly identified the culprit as question mark ?.
If I want to do regex in drilldown, the link returns "Unbalanced quotes"; search windows shows the search as cut off at the first left parenthesis, even though the URL appears to contain the full string. The only difference I can see is that the URL contains something like q=sourcetype=%22mytype%22 instead of q=sourcetype%3D%22awx_json%22, i.e., all equal signs in the search is no longer encoded. If I do not have parenthesis after pipe, the drilldown automatically encodes equal sign. (Even so, it is not obvious why the resultant search window shows a cutoff at parenthesis.)
Additionally, if I urldecode the string, the resultant search is still invalid because the time range, as specified in tokens, gets attached to the last filter (with ampersands - instead of inserting into the first search command) which renders the last filter invalid.
