Bug? Custom drilldown cannot handle question mark

[yuanliu]

Update: I found this question https://answers.splunk.com/answers/610037/my-search-string-is-truncated-after-a-question-mar.html that correctly identified the culprit as question mark ?.

If I want to do regex in drilldown, the link returns "Unbalanced quotes"; search windows shows the search as cut off at the first left parenthesis, even though the URL appears to contain the full string. The only difference I can see is that the URL contains something like q=sourcetype=%22mytype%22 instead of q=sourcetype%3D%22awx_json%22, i.e., all equal signs in the search is no longer encoded. If I do not have parenthesis after pipe, the drilldown automatically encodes equal sign. (Even so, it is not obvious why the resultant search window shows a cutoff at parenthesis.)

Additionally, if I urldecode the string, the resultant search is still invalid because the time range, as specified in tokens, gets attached to the last filter (with ampersands - instead of inserting into the first search command) which renders the last filter invalid.

[yuanliu]

Obviously this can be worked around by hard encoding, perhaps even hard code time range tokens, too. But this behavior is very undesirable.

[yuanliu]

Looks like @sabirmgd reported this a year ago in https://answers.splunk.com/answers/610037/my-search-string-is-truncated-after-a-question-mar.html and @mayurr98 diagnosed it correctly. The problem is in question mark, not in parenthesis. (The equal sign encoding is still odd.)