When I use the below drilldown query without eval its working fine and I'm getting the result as expected. But when I add eval in the drilldown query and click on the values a new search window is opened and its empty. In the search bar, I am not able to see the query too. Option: link to search
/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request"
| eval Month=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%B")
| eval Year=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%Y")
| stats count by GROUP
Thanks in advance.
@shankarananth,
I think you have to encode url. Can you please try below link in drilldown?
/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP
Thanks
@shankarananth,
I think you have to encode url. Can you please try below link in drilldown?
/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP
Thanks
Thanks for your response . Yes ur right .. I need to encode .. Is there any specific link for it .. So i can go through it and complete my query . Because i need to change in many palces ..
Hi @shankarananth,
Please use https://www.urlencoder.org/ for encoding & decoding.
Can you please accept the answer and If you got your answer? It will help community.
Happy Splunking
@kamlesh_vaghela -- Thank you for your help ..
Happy Splunking 🙂