Splunk Search

Why is the Drilldown not working?

Shan
Builder

When I use the below drilldown query without eval its working fine and I'm getting the result as expected. But when I add eval in the drilldown query and click on the values a new search window is opened and its empty. In the search bar, I am not able to see the query too. Option: link to searchalt text

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium"    TIER_1 !="Request"
| eval Month=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%B")
| eval Year=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%Y") 
| stats count by GROUP 

Thanks in advance.

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth,

I think you have to encode url. Can you please try below link in drilldown?

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP 

Thanks

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@shankarananth,

I think you have to encode url. Can you please try below link in drilldown?

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP 

Thanks

Shan
Builder

Thanks for your response . Yes ur right .. I need to encode .. Is there any specific link for it .. So i can go through it and complete my query . Because i need to change in many palces ..

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @shankarananth,
Please use https://www.urlencoder.org/ for encoding & decoding.

Can you please accept the answer and If you got your answer? It will help community.

Happy Splunking

0 Karma

Shan
Builder

@kamlesh_vaghela -- Thank you for your help ..
Happy Splunking 🙂

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...