Splunk Search

Bug? Custom drilldown cannot handle question mark

yuanliu
SplunkTrust
SplunkTrust

Update: I found this question https://answers.splunk.com/answers/610037/my-search-string-is-truncated-after-a-question-mar.html that correctly identified the culprit as question mark ?.

If I want to do regex in drilldown, the link returns "Unbalanced quotes"; search windows shows the search as cut off at the first left parenthesis, even though the URL appears to contain the full string. The only difference I can see is that the URL contains something like q=sourcetype=%22mytype%22 instead of q=sourcetype%3D%22awx_json%22, i.e., all equal signs in the search is no longer encoded. If I do not have parenthesis after pipe, the drilldown automatically encodes equal sign. (Even so, it is not obvious why the resultant search window shows a cutoff at parenthesis.)

Additionally, if I urldecode the string, the resultant search is still invalid because the time range, as specified in tokens, gets attached to the last filter (with ampersands - instead of inserting into the first search command) which renders the last filter invalid.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Obviously this can be worked around by hard encoding, perhaps even hard code time range tokens, too. But this behavior is very undesirable.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Looks like @sabirmgd reported this a year ago in https://answers.splunk.com/answers/610037/my-search-string-is-truncated-after-a-question-mar.html and @mayurr98 diagnosed it correctly. The problem is in question mark, not in parenthesis. (The equal sign encoding is still odd.)

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...