- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi there,
I am trying to enable drilldown on a dashboard view to use a custom search(see below search string snippet). Although the search with the aforementioned string works fine on its own but its complaining when I use it within the drilldown custom search saying "Unbalanced quotes". Any idea why ? Thanks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You have some non-encoded parts of the query in that URL - not sure how they are there, but for example
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success=%5C%22false%5C%22%22%0A%7Crex%20field=_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs+%5Cw+%5Cs+%5Cw+%5Cs+%5Cd+%5Cs+%5Cw+%5Cs+(?P%3CUUID%3E%5Cw+)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&earliest=$field1.earliest$&latest=$field1.latest$</link>
Those contain the following characters that are not encoded (=+?)
The line should be
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success%3D%5C%22false%5C%22%22%0A%7Crex%20field%3D_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs%2B%5Cw%2B%5Cs%2B%5Cw%2B%5Cs%2B%5Cd%2B%5Cs%2B%5Cw%2B%5Cs%2B(%3FP%3CUUID%3E%5Cw%2B)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&earliest=$field1.earliest$&latest=$field1.latest$</link>
Note the encoding of = (%3D), + (%2B) and ? (%3F)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Edit your dashboard in Source mode, so you can see your XML.
Please post your link target string for the drilldown. It should be something like this (this is not exactly the same as yours
<drilldown>
<link target="_blank">search?q=index%3D_audit%20%0A%7C%20rex%20field%3D_raw%20%22%5E%5B%5E%5C%5C%5D%5C%5Cn%5D*%5C%5C%5D%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B%5C%5Cd%2B%5C%5Cs%2B%5C%5Cw%2B%5C%5Cs%2B(%3FP%3CUUID%3E%5C%5Cw%2B)%22&earliest=-15m&latest=now</link>
</drilldown>
It is most likely that some encoding issue with editing the link in the UI or the source is causing the issue, as you can see that the search string is truncated before the end
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bowesmana here it is 🙂
<drilldown>
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success=%5C%22false%5C%22%22%0A%7Crex%20field=_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs+%5Cw+%5Cs+%5Cw+%5Cs+%5Cd+%5Cs+%5Cw+%5Cs+(?P%3CUUID%3E%5Cw+)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&earliest=$field1.earliest$&latest=$field1.latest$</link>
</drilldown>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You have some non-encoded parts of the query in that URL - not sure how they are there, but for example
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success=%5C%22false%5C%22%22%0A%7Crex%20field=_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs+%5Cw+%5Cs+%5Cw+%5Cs+%5Cd+%5Cs+%5Cw+%5Cs+(?P%3CUUID%3E%5Cw+)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&earliest=$field1.earliest$&latest=$field1.latest$</link>
Those contain the following characters that are not encoded (=+?)
The line should be
<link target="_blank">search?q=$env$%20%22TechnicalWorkFlow.spkFormSubmissionGlobalOptIn%22%20AND%20%22Opt%20In%20Response%20%3Cresult%20success%3D%5C%22false%5C%22%22%0A%7Crex%20field%3D_raw%20%22%5E%5B%5E%5C%5D%5Cn%5D*%5C%5D%5Cs%2B%5Cw%2B%5Cs%2B%5Cw%2B%5Cs%2B%5Cd%2B%5Cs%2B%5Cw%2B%5Cs%2B(%3FP%3CUUID%3E%5Cw%2B)%22%0A%7Cdedup%20UUID%0A%7Ctable%20UUID%20_time&earliest=$field1.earliest$&latest=$field1.latest$</link>
Note the encoding of = (%3D), + (%2B) and ? (%3F)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@bowesmana Thanks heaps, that worked like a charm! However keen to know if you used a particular tool for the encoding as it appears each time I modify the custom search string in the drilldown option, it messes up the encoding ??
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

That's odd - I am using Splunk 8.2.6 for that example and I have edited the drilldown search in the UI and it correctly encodes the link - I checked the source view of the link.
I have added extra equals signs. extra rex statements with additional var extraction and can't make it fail.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I've personally experienced this in the past. Though don't remember any recent scenario of incorrectly encoded search string.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You could search for URL encoder/decoders on the internet, however, be warned that they may encode/decode $/%24 which would disrupt your token usage if not corrected.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Yeah, tokens are a bit of a hassle when using those online tools.
I generally use Splunk UI to write/update the query and remember which part Splunk is not encoding properly and do those changes only manually.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

@Trex1 - I see you have used double backslashes \\w, \\n.
Use just single braces, like for new line \n, for space \s, etc.
Except for \\ which I'm guessing you need backslash as a character in your event.
Also, in the search string, you need to escape double quotes. So your search would look something like this:
AND "Opt in Response <result success=\"false\""
I hope this helps!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@VatsalJagani Unfortunately that didn't fix the issue. It still complains about unbalanced quotes in the search. Not sure if this is a search string problem or something else.
