Drilldown option is not working for Custom Search

[Trex1]

Hi there, 

I am trying to enable drilldown on a dashboard view to use a custom search(see below search string snippet). Although the search with the aforementioned string works fine on its own but its complaining when I use it within the drilldown custom search saying "Unbalanced quotes". Any idea why ? Thanks.

[bowesmana]

Edit your dashboard in Source mode, so you can see your XML.

Please post your link target string for the drilldown. It should be something like this (this is not exactly the same as yours

        <drilldown>
          <link target="_blank">search?q=index%3D_audit%20%0A%7C%20rex%20field%3D_raw%20%22%5E%5B%5E%5C%5C%5D%5C%5Cn%5D*%5C%5C%5D%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B%5C%5Cd%2B%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B(%3FP%3CUUID%3E%5C%5Cw%2B)%22&amp;earliest=-15m&amp;latest=now</link>
        </drilldown>

It is most likely that some encoding issue with editing the link in the UI or the source is causing the issue, as you can see that the search string is truncated before the end

[Trex1]

@bowesmana here it is 🙂

<drilldown>
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success=%5C%22false%5C%22%22%0A%7Crex%20field=_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs+%5Cw+%5Cs+%5Cw+%5Cs+%5Cd+%5Cs+%5Cw+%5Cs+(?P%3CUUID%3E%5Cw+)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>
</drilldown>

[bowesmana · Accepted solution]

You have some non-encoded parts of the query in that URL - not sure how they are there, but for example

<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success=%5C%22false%5C%22%22%0A%7Crex%20field=_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs+%5Cw+%5Cs+%5Cw+%5Cs+%5Cd+%5Cs+%5Cw+%5Cs+(?P%3CUUID%3E%5Cw+)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>

Those contain the following characters that are not encoded (=+?)

The line should be

          <link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success%3D%5C%22false%5C%22%22%0A%7Crex%20field%3D_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs%2B%5Cw%2B%5Cs%2B%5Cw%2B%5Cs%2B%5Cd%2B%5Cs%2B%5Cw%2B%5Cs%2B(%3FP%3CUUID%3E%5Cw%2B)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&amp;earliest=$field1.earliest$&amp;latest=$field1.latest$</link>

Note the encoding of = (%3D), + (%2B) and ? (%3F)

[Trex1]

@bowesmana Thanks heaps, that worked like a charm! However keen to know if you used a particular tool for the encoding as it appears each time I modify the custom search string in the drilldown option, it messes up the encoding ??

[bowesmana]

That's odd - I am using Splunk 8.2.6 for that example and I have edited the drilldown search in the UI and it correctly encodes the link - I checked the source view of the link.

I have added extra equals signs. extra rex statements with additional var extraction and can't make it fail.

[VatsalJagani]

I've personally experienced this in the past. Though don't remember any recent scenario of incorrectly encoded search string.

[ITWhisperer]

You could search for URL encoder/decoders on the internet, however, be warned that they may encode/decode $/%24 which would disrupt your token usage if not corrected.

[VatsalJagani]

Yeah, tokens are a bit of a hassle when using those online tools.

I generally use Splunk UI to write/update the query and remember which part Splunk is not encoding properly and do those changes only manually.

[VatsalJagani]

@Trex1 - I see you have used double backslashes \\w, \\n.

Use just single braces, like for new line \n, for space \s, etc.

Except for \\ which I'm guessing you need backslash as a character in your event.

Also, in the search string, you need to escape double quotes. So your search would look something like this:

AND "Opt in Response <result success=\"false\""

I hope this helps!!!

[Trex1]

@VatsalJagani Unfortunately that didn't fix the issue. It still complains about unbalanced quotes in the search. Not sure if this is a search string problem or something else.