Prevent " in Drilldown Onclick

[jokovitch]

I have Drilldown that show me some Test and this is Onclick:

index=main |where Test="$click.value$"

The problem is when $click.value$ contains  Double quote (")

And then I got an error in Search screen "Unbalanced quotes"

How to fix it ?

[kamlesh_vaghela]

@jokovitch 

Try this in drilldown search,

$click.value|s$

https://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens#Token_filters

KV

[jokovitch]

That didn't help.

Because it's add " in the beginning and in the end of Test . so now it's open the search Windows with this query

index="main"|where Test=""Dog""

So i got an error : Error in where command: the operator at Dog"" is invalid

[kamlesh_vaghela]

@jokovitch 

Can you please try this?

<dashboard>
  <label>Prevent " in Drilldown Onclick</label>
  <row>
    <panel>
      <title>$val$</title>
      <table>
        <search>
          <query>| makeresults | eval test="\"Dog\"" | table test</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">row</option>
        <drilldown>
          <eval token="val">replace($click.value$,"\"","\\\"")</eval>
          <link target="_blank">search?q=| makeresults | eval test="$val$"&amp;earliest=-24h@h&amp;latest=now</link>
        </drilldown>
      </table>
    </panel>
  </row>
</dashboard>

Please check drilldown logic.

KV