Splunk Search

Table drilldowns: Problem with forward slash

enexwhy
Explorer

Hi community,

I am trying to create a drilldown for a table using a cell value that contains a URL (or part of it).
These are the problems I'm facing:
1) Splunk converts the '/' in the cell value to '%2F'.
2) Cell becomes unclickable when cell value (containing part of URL) starts with '/'.

To explain the problems, here is a table with different use cases that you can also copy and play with:

<table>
    <search>
        <query>index=_internal | head 1
        | eval can_click = "dev.splunk.com"
        | eval cannot_click = "dev.splunk.com/view/webframework-codeexamples/SP-CAAAEVU"
        | eval can_click_but_forward_slashes_replaced = "view/webframework-codeexamples/SP-CAAAEVU"
        | table can_click, cannot_click, can_click_but_forward_slashes_replaced, with_cdata__cannot_click, with_cdata__can_click_but_forward_slashes_replaced
        </query>
    </search>
    <drilldown target="_blank">
        <condition field="can_click">
            <link>http://$row.can_click$</link>
        </condition>
        <condition field="cannot_click">
            <link>http://$row.cannot_click$</link>
        </condition>
        <condition field="can_click_but_forward_slashes_replaced">
            <link>http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced$</link>
        </condition>
        <condition field="with_cdata__cannot_click">
            <link><![CDATA[http://$row.cannot_click$]]></link>
        </condition>
        <condition field="with_cdata__can_click_but_forward_slashes_replaced">
            <link><![CDATA[http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced$]]></link>
        </condition>
    </drilldown>
</table>
  1. can_click Contains a URL with no forward slashes -- works fine.
  2. cannot_click Contains a URL that has a forward slash right after '.com' -- does not respond to clicks.
  3. can_click_but_forward_slashes_replaced Contains a URL that has forward slashes but not right after a '.com' -- responds but forward slashes are replaced with '%2F'. :: Note that if it started with a forward slash, it will be the same as case 2.
  4. with_cdata__cannot_click Same as case 2 but enclosed in CDATA tag.
  5. with_cdata__can_click_but_forward_slashes_replaced Same as case 3 but enclosed in CDATA tag.

My question: How can make a drilldown use a cell value containing a URL (or even just part of it)?

0 Karma
1 Solution

niketn
Legend

You have to enable no character escaping using n$ in all your tokens having URL escape characters. Following should work.

<drilldown>
   <condition field="can_click">
       <link>http://$row.can_click$</link>
   </condition>
   <condition field="cannot_click">
       <link>http://$row.cannot_click|n$</link>
   </condition>
   <condition field="can_click_but_forward_slashes_replaced">
       <link>http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$</link>
   </condition>
   <condition field="with_cdata__cannot_click">
       <link><![CDATA[http://$row.cannot_click|n$]]></link>
   </condition>
   <condition field="with_cdata__can_click_but_forward_slashes_replaced">
       <link><![CDATA[http://dev.splunk.com/$row.can_click_but_forward_slashes_replaced|n$]]></link>
   </condition>          
</drilldown>

Refer to the documentation for details: http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...