Splunk Search
Highlighted

Problem with my custom drill down source code

Explorer

My problem is that after I add my custom drilldown code and select an item in my results, it takes me to the specified search string in the custom drilldown but it DOES NOT display the entire search string and therefore, no results show up.

For example below is my custom drilldown code:

<drilldown>
              <condition field="Switched to different user account">
               <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition field="Added new user to group">
                <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition field="Created new user">
                <link target="_blank">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</link>
              </condition>
              <condition>
                <!-- Optional No Drilldown from other columns-->
              </condition>
        </drilldown>

And then I click an item in my list of results to drill down to it and it almost works but here is the search string the drill tries to use:

index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(

It is an incomplete version of the search string I specified in my drilldown source code.
Is this happening because of the regex? How do I fix this?

0 Karma
Highlighted

Re: Problem with my custom drill down source code

Legend

Hi jcorkey,
the problem is that ? is a special char for url.
Probably the easiest way is to extract the userOfInterest field using the Field Extractor so you don't need to pass the regex in the url.
Onl yto understand: Why do you want to pass the entire search as url?
Bye.
Giuseppe

0 Karma
Highlighted

Re: Problem with my custom drill down source code

Explorer

Thanks. I am just trying to figure out how to execute any search string when one of those three items are clicked from the visualization table. I want to use a regex so I can easily use this search on different Splunk enterprises without having to configure the extraction on each Splunk instance for right now.

0 Karma
Highlighted

Re: Problem with my custom drill down source code

Contributor

Can you try |u to escape URL special chars? I usually set me a token with my drilldown search, so something in the spirit of this:

<drilldown target="_blank">
<set token="drill">search?q=index=* host=* sourcetype="*" user="*" useradd "new user:"| rex "^[^=\n]*=(?P<userOfInterest>\w+)"&amp;earliest=-24h@h&amp;latest=now</set>
<link>$drill|u$</link>
</drilldown>
0 Karma