Drilldown not working, even when using <![CDATA]]>

[UMDTERPS]

I am having a similar issue to this thread here, but my drilldown search still won't work (explanation below):

https://community.splunk.com/t5/Dashboards-Visualizations/In-a-dashboard-why-can-t-I-configure-a-dri...

I have a panel on my dashboard  with a custom drilldown and search.  The search works perfectly when running it as a search on it's own.  However, in the search string we have a "rex" and those don't play nice with drilldowns and XML. 

|rex field=field1 "^(?<field2>[^ ]+)"

Apparently, according to the thread above,  you need to  wrap the data in "<!CDATA[]]?>":

 <link target="_blank"><![CDATA[ search?earliest=&latest=&q=|inputlookup = blah |rex field=field2 "^(?<field>[^ ]+)"|search continues....]]></link>

The drilldown will execute and open another tab, but the search stops at 

rex field=field2 "^(

I get an error saying "Unbalanced quotes."  The search runs on it's own, but not when using a custom drilldown search and wrapping the search in "CDATA."

Any ideas on how to get this search running with rex and no errors in a custom drilldown?

Thanks

[richgalloway]

Try URL-encoding the drilldown target.

[UMDTERPS]

https://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/OverviewofSimplifiedXML#Special_characters_in...

|rex field=field1 "^(?<field2>[^ ]+)"

URL Encoded below:

| rex field=field1 &quot;^(?&lt;field2&gt;[^ ]+)&quot;

I'm assuming this is what you mean?

When I run the the drilldown, I get:

Error in 'SearchParser': Missing a search command before '^'. Error at position '211' of search query '| inputlookup data.csv ...{snipped} {errorcontext = IG_ID>[^ ]+)"}'.

[richgalloway · Accepted solution]

The original drilldown was failing because the "?" character separates arguments in a URL.  Including one in the search query effectively ending the query.  The "?" needs to be encoded if nothing else.

[UMDTERPS]

Yeah, I ended up replacing the "?" with "%3F" and the "+" with "%2B" in the  "<link target="_blank">search?q=.....</link>" and it worked.

Seems like it's not listed here?:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/OverviewofSimplifiedXML

Thanks

[richgalloway]

Submit feedback on that doc page letting them know of your experience.  They'll likely change the page.

[UMDTERPS]

Thanks, I submitted feedback on  the page. 👍