On a dashboard I have a panel with the following search:
index="perfmon" counter="% Processor Time" host!="HOST1*" host!="HOST2" host!="HOST3" | bucket _time span=35m | stats avg(Value) AS AVERAGE count(Value) AS INSTANCES by host | where AVERAGE > 25 | where INSTANCES >= 2 | eval Occurances=Round(INSTANCES/2,0) | table host Occurances | head 10 | sort Occurances | reverse
I just discovered drilldowns, so I set it to Link to Search (Custom) new tab.
index="perfmon" counter="% Processor Time" host="$click.value2$"
I click the left most column (host), and it all I see is "Loading...". I inspect Chrome's console and I see "malformed Uri" error. Comparing the URL to that of a normal search and it seems a bit off.
vs a regular search
I think it's missing q=search and is not encoding the URL properly (equal signs specifically). My version is 7.0 for the server.
I've resorted to just using a URL (to create the search manually), but that's really not ideal.
It seems that splunk does not url-encode the % character on drilldown. That looks like a bug, a quick fix is to do it yourself. Edit the Simple XML of your dashboard (Edit - Source) and find the line where it says
<drilldown> <link target="_blank">search?q=index="perfmon" counter="% Processor Time" host="$click.value2$"</link> </drilldown>
Change the percent sign to its url encoded value
%25 like this:
<drilldown> <link target="_blank">search?q=index="perfmon" counter="%25 Processor Time" host="$click.value2$"</link> </drilldown>
And it should work as expected.
Try the following which has URL Encoding for Quotes, Spaces and Percent:
<drilldown> <link target="_blank">search?q=index=%22perfmon%22%20counter=%22%2525%20Processor%20Time%22%20host=%22$click.value2$%22&earliest=-24h@h&latest=now</link> </drilldown>
Moreover, if you are on
Splunk Enterprise 6.6 or higher you do not need to code Drilldown, this feature is available through UI Edit itself. Which implies if you create a drilldown link to search via UI, you do not have to worry about URL Encoding as Splunk will do it for you. Please try out and confirm.
IIRC, quotes and spaces are encoded correctly on drilldown regardless of what you set in Simple XML - only percent isn't. I don't know whether using the UI editor makes a difference (if it encodes the url on writing it to Simple XML, it could make a difference - otherwise it shouldn't).
I ran into this issue in the UI for Splunk 7.0.0 and had to manual perform the URL encoding, as recommended here... that is, when adding a search string to the panel to define a custom drill-down action (Is there another path that obviates the need to perform manual URL encoding?)