Custom drilldown search not working

[tmontney]

On a dashboard I have a panel with the following search:

index="perfmon" counter="% Processor Time" host!="HOST1*" host!="HOST2" host!="HOST3"
| bucket _time span=35m
| stats avg(Value) AS AVERAGE count(Value) AS INSTANCES by host
| where AVERAGE > 25
| where INSTANCES >= 2
| eval Occurances=Round(INSTANCES/2,0)
| table host Occurances
| head 10
| sort Occurances
| reverse

I just discovered drilldowns, so I set it to Link to Search (Custom) new tab.

index="perfmon" counter="% Processor Time" host="$click.value2$"

I click the left most column (host), and it all I see is "Loading...". I inspect Chrome's console and I see "malformed Uri" error. Comparing the URL to that of a normal search and it seems a bit off.

https://MYSPLKSERVER/en-US/app/MYAPP/search?q=index=%22perfmon%22%20counter=%22%%20Processor%20Time%...

vs a regular search

https://MYSPLKSERVER/en-US/app/MYAPP/search?q=search%20index%3D%22perfmon%22%20counter%3D%22%25%20Pr...

I think it's missing q=search and is not encoding the URL properly (equal signs specifically). My version is 7.0 for the server.

I've resorted to just using a URL (to create the search manually), but that's really not ideal.

[davidcaccia]

I ran into this issue in the UI for Splunk 7.0.0 and had to manual perform the URL encoding, as recommended here... that is, when adding a search string to the panel to define a custom drill-down action (Is there another path that obviates the need to perform manual URL encoding?)

[niketn]

Try the following which has URL Encoding for Quotes, Spaces and Percent:

<drilldown>
  <link target="_blank">search?q=index=%22perfmon%22%20counter=%22%2525%20Processor%20Time%22%20host=%22$click.value2$%22&amp;earliest=-24h@h&amp;latest=now</link>
</drilldown>

Moreover, if you are on Splunk Enterprise 6.6 or higher you do not need to code Drilldown, this feature is available through UI Edit itself. Which implies if you create a drilldown link to search via UI, you do not have to worry about URL Encoding as Splunk will do it for you. Please try out and confirm.

[davebo1896]

%2525 in simplexml is a workaround (as of 7.2.3)
You can also replace % with %25 in the UI editing view

[jeffland]

IIRC, quotes and spaces are encoded correctly on drilldown regardless of what you set in Simple XML - only percent isn't. I don't know whether using the UI editor makes a difference (if it encodes the url on writing it to Simple XML, it could make a difference - otherwise it shouldn't).

[jeffland · Accepted solution]

It seems that splunk does not url-encode the % character on drilldown. That looks like a bug, a quick fix is to do it yourself. Edit the Simple XML of your dashboard (Edit - Source) and find the line where it says

<drilldown>
  <link target="_blank">search?q=index="perfmon" counter="% Processor Time" host="$click.value2$"</link>
</drilldown>

Change the percent sign to its url encoded value %25 like this:

<drilldown>
  <link target="_blank">search?q=index="perfmon" counter="%25 Processor Time" host="$click.value2$"</link>
</drilldown>

And it should work as expected.

[nickdewijer]

I'm experiencing the same problem with having upgraded to 7.2.1 (newest version of splunk as of this writing)

[jeffland]

If you have a support entitlement, you could file a bug report.

[davebo1896]

SPL-163158 is the bug number