Splunk Search

Prevent " in Drilldown Onclick

jokovitch
Explorer

I have Drilldown that show me some Test and this is Onclick:

 

index=main |where Test="$click.value$"

 

The problem is when $click.value$ contains  Double quote (")

 

And then I got an error in Search screen "Unbalanced quotes"

 

How to fix it ?

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust
0 Karma

jokovitch
Explorer

That didn't help.

Because it's add " in the beginning and in the end of Test . so now it's open the search Windows with this query

index="main"|where Test=""Dog""

So i got an error : Error in where command: the operator at Dog"" is invalid

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jokovitch 

Can you please try this?

<dashboard>
  <label>Prevent " in Drilldown Onclick</label>
  <row>
    <panel>
      <title>$val$</title>
      <table>
        <search>
          <query>| makeresults | eval test="\"Dog\"" | table test</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="val">replace($click.value$,"\"","\\\"")</eval>
          <link target="_blank">search?q=| makeresults | eval test="$val$"&amp;earliest=-24h@h&amp;latest=now</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

 

Please check drilldown logic.

KV

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...