Splunk Search

Drilldown not working, even when using <![CDATA]]>

UMDTERPS
Communicator

I am having a similar issue to this thread here, but my drilldown search still won't work (explanation below):

https://community.splunk.com/t5/Dashboards-Visualizations/In-a-dashboard-why-can-t-I-configure-a-dri...

I have a panel on my dashboard  with a custom drilldown and search.  The search works perfectly when running it as a search on it's own.  However, in the search string we have a "rex" and those don't play nice with drilldowns and XML. 

 

|rex field=field1 "^(?<field2>[^ ]+)"

 

Apparently, according to the thread above,  you need to  wrap the data in "<!CDATA[]]?>":

 

 <link target="_blank"><![CDATA[ search?earliest=&latest=&q=|inputlookup = blah |rex field=field2 "^(?<field>[^ ]+)"|search continues....]]></link>

 

The drilldown will execute and open another tab, but the search stops at 

 

rex field=field2 "^(

 

I get an error saying "Unbalanced quotes."  The search runs on it's own, but not when using a custom drilldown search and wrapping the search in "CDATA."

Any ideas on how to get this search running with rex and no errors in a custom drilldown?

Thanks

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The original drilldown was failing because the "?" character separates arguments in a URL.  Including one in the search query effectively ending the query.  The "?" needs to be encoded if nothing else.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try URL-encoding the drilldown target.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

UMDTERPS
Communicator


https://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/OverviewofSimplifiedXML#Special_characters_in...

|rex field=field1 "^(?<field2>[^ ]+)"

URL Encoded below:

| rex field=field1 &quot;^(?&lt;field2&gt;[^ ]+)&quot;


I'm assuming this is what you mean?

When I run the the drilldown, I get:

Error in 'SearchParser': Missing a search command before '^'. Error at position '211' of search query '| inputlookup data.csv ...{snipped} {errorcontext = IG_ID&gt;[^ ]+)&quot;}'.




0 Karma

richgalloway
SplunkTrust
SplunkTrust

The original drilldown was failing because the "?" character separates arguments in a URL.  Including one in the search query effectively ending the query.  The "?" needs to be encoded if nothing else.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

UMDTERPS
Communicator

Yeah, I ended up replacing the "?" with "%3F" and the "+" with "%2B" in the  "<link target="_blank">search?q=.....</link>" and it worked.

Seems like it's not listed here?:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/OverviewofSimplifiedXML

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Submit feedback on that doc page letting them know of your experience.  They'll likely change the page.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

UMDTERPS
Communicator

Thanks, I submitted feedback on  the page. 👍

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!