On a dashboard I have a panel with the following search:
index="perfmon" counter="% Processor Time" host!="HOST1*" host!="HOST2" host!="HOST3"
| bucket _time span=35m
| stats avg(Value) AS AVERAGE count(Value) AS INSTANCES by host
| where AVERAGE > 25
| where INSTANCES >= 2
| eval Occurances=Round(INSTANCES/2,0)
| table host Occurances
| head 10
| sort Occurances
| reverse
I just discovered drilldowns, so I set it to Link to Search (Custom) new tab.
index="perfmon" counter="% Processor Time" host="$click.value2$"
I click the left most column (host), and it all I see is "Loading...". I inspect Chrome's console and I see "malformed Uri" error. Comparing the URL to that of a normal search and it seems a bit off.
https://MYSPLKSERVER/en-US/app/MYAPP/search?q=index=%22perfmon%22%20counter=%22%%20Processor%20Time%...
vs a regular search
https://MYSPLKSERVER/en-US/app/MYAPP/search?q=search%20index%3D%22perfmon%22%20counter%3D%22%25%20Pr...
I think it's missing q=search and is not encoding the URL properly (equal signs specifically). My version is 7.0 for the server.
I've resorted to just using a URL (to create the search manually), but that's really not ideal.
It seems that splunk does not url-encode the % character on drilldown. That looks like a bug, a quick fix is to do it yourself. Edit the Simple XML of your dashboard (Edit - Source) and find the line where it says
<drilldown>
<link target="_blank">search?q=index="perfmon" counter="% Processor Time" host="$click.value2$"</link>
</drilldown>
Change the percent sign to its url encoded value %25
like this:
<drilldown>
<link target="_blank">search?q=index="perfmon" counter="%25 Processor Time" host="$click.value2$"</link>
</drilldown>
And it should work as expected.
I ran into this issue in the UI for Splunk 7.0.0 and had to manual perform the URL encoding, as recommended here... that is, when adding a search string to the panel to define a custom drill-down action (Is there another path that obviates the need to perform manual URL encoding?)
Try the following which has URL Encoding for Quotes, Spaces and Percent:
<drilldown>
<link target="_blank">search?q=index=%22perfmon%22%20counter=%22%2525%20Processor%20Time%22%20host=%22$click.value2$%22&earliest=-24h@h&latest=now</link>
</drilldown>
Moreover, if you are on Splunk Enterprise 6.6
or higher you do not need to code Drilldown, this feature is available through UI Edit itself. Which implies if you create a drilldown link to search via UI, you do not have to worry about URL Encoding as Splunk will do it for you. Please try out and confirm.
%2525 in simplexml is a workaround (as of 7.2.3)
You can also replace % with %25 in the UI editing view
IIRC, quotes and spaces are encoded correctly on drilldown regardless of what you set in Simple XML - only percent isn't. I don't know whether using the UI editor makes a difference (if it encodes the url on writing it to Simple XML, it could make a difference - otherwise it shouldn't).
It seems that splunk does not url-encode the % character on drilldown. That looks like a bug, a quick fix is to do it yourself. Edit the Simple XML of your dashboard (Edit - Source) and find the line where it says
<drilldown>
<link target="_blank">search?q=index="perfmon" counter="% Processor Time" host="$click.value2$"</link>
</drilldown>
Change the percent sign to its url encoded value %25
like this:
<drilldown>
<link target="_blank">search?q=index="perfmon" counter="%25 Processor Time" host="$click.value2$"</link>
</drilldown>
And it should work as expected.
I'm experiencing the same problem with having upgraded to 7.2.1 (newest version of splunk as of this writing)
If you have a support entitlement, you could file a bug report.
SPL-163158 is the bug number