Problem with my custom drill down source code

[jcorkey]

My problem is that after I add my custom drilldown code and select an item in my results, it takes me to the specified search string in the custom drilldown but it DOES NOT display the entire search string and therefore, no results show up.

For example below is my custom drilldown code:

<drilldown>
              <condition field="Switched to different user account">
               <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition field="Added new user to group">
                <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition field="Created new user">
                <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition>
                <!-- Optional No Drilldown from other columns-->
              </condition>
        </drilldown>

And then I click an item in my list of results to drill down to it and it almost works but here is the search string the drill tries to use:

index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(

It is an incomplete version of the search string I specified in my drilldown source code.
Is this happening because of the regex? How do I fix this?

[knielsen]

Can you try |u to escape URL special chars? I usually set me a token with my drilldown search, so something in the spirit of this:

<drilldown target="_blank">
<set token="drill">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</set>
<link>$drill|u$</link>
</drilldown>

[gcusello]

Hi jcorkey,
the problem is that ? is a special char for url.
Probably the easiest way is to extract the userOfInterest field using the Field Extractor so you don't need to pass the regex in the url.
Onl yto understand: Why do you want to pass the entire search as url?
Bye.
Giuseppe

[jcorkey]

Thanks. I am just trying to figure out how to execute any search string when one of those three items are clicked from the visualization table. I want to use a regex so I can easily use this search on different Splunk enterprises without having to configure the extraction on each Splunk instance for right now.