Splunk Search

Drilldown not working, even when using <![CDATA]]>

UMDTERPS
Communicator

I am having a similar issue to this thread here, but my drilldown search still won't work (explanation below):

https://community.splunk.com/t5/Dashboards-Visualizations/In-a-dashboard-why-can-t-I-configure-a-dri...

I have a panel on my dashboard  with a custom drilldown and search.  The search works perfectly when running it as a search on it's own.  However, in the search string we have a "rex" and those don't play nice with drilldowns and XML. 

 

|rex field=field1 "^(?<field2>[^ ]+)"

 

Apparently, according to the thread above,  you need to  wrap the data in "<!CDATA[]]?>":

 

 <link target="_blank"><![CDATA[ search?earliest=&latest=&q=|inputlookup = blah |rex field=field2 "^(?<field>[^ ]+)"|search continues....]]></link>

 

The drilldown will execute and open another tab, but the search stops at 

 

rex field=field2 "^(

 

I get an error saying "Unbalanced quotes."  The search runs on it's own, but not when using a custom drilldown search and wrapping the search in "CDATA."

Any ideas on how to get this search running with rex and no errors in a custom drilldown?

Thanks

Labels (2)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The original drilldown was failing because the "?" character separates arguments in a URL.  Including one in the search query effectively ending the query.  The "?" needs to be encoded if nothing else.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try URL-encoding the drilldown target.

---
If this reply helps you, Karma would be appreciated.
0 Karma

UMDTERPS
Communicator


https://docs.splunk.com/Documentation/Splunk/7.1.3/Viz/OverviewofSimplifiedXML#Special_characters_in...

|rex field=field1 "^(?<field2>[^ ]+)"

URL Encoded below:

| rex field=field1 &quot;^(?&lt;field2&gt;[^ ]+)&quot;


I'm assuming this is what you mean?

When I run the the drilldown, I get:

Error in 'SearchParser': Missing a search command before '^'. Error at position '211' of search query '| inputlookup data.csv ...{snipped} {errorcontext = IG_ID&gt;[^ ]+)&quot;}'.




0 Karma

richgalloway
SplunkTrust
SplunkTrust

The original drilldown was failing because the "?" character separates arguments in a URL.  Including one in the search query effectively ending the query.  The "?" needs to be encoded if nothing else.

---
If this reply helps you, Karma would be appreciated.

UMDTERPS
Communicator

Yeah, I ended up replacing the "?" with "%3F" and the "+" with "%2B" in the  "<link target="_blank">search?q=.....</link>" and it worked.

Seems like it's not listed here?:

https://docs.splunk.com/Documentation/Splunk/8.1.2/Viz/OverviewofSimplifiedXML

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Submit feedback on that doc page letting them know of your experience.  They'll likely change the page.

---
If this reply helps you, Karma would be appreciated.
0 Karma

UMDTERPS
Communicator

Thanks, I submitted feedback on  the page. 👍

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...