Splunk Search

Why is the Drilldown not working?

When I use the below drilldown query without eval its working fine and I'm getting the result as expected. But when I add eval in the drilldown query and click on the values a new search window is opened and its empty. In the search bar, I am not able to see the query too. Option: link to searchalt text

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium"    TIER_1 !="Request"
| eval Month=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%B")
| eval Year=strftime(strptime(SOLVEDDATE,"%Y-%m-%d"),"%Y") 
| stats count by GROUP 

Thanks in advance.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@shankarananth,

I think you have to encode url. Can you please try below link in drilldown?

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP 

Thanks

View solution in original post

SplunkTrust
SplunkTrust

@shankarananth,

I think you have to encode url. Can you please try below link in drilldown?

/app/search/search?q=index=XXXX source=BDAF GROUP="$ABCD$" OR GROUP="DATA" CATEGORY="Failure" PRIORITY="Low" OR PRIORITY="Medium" TIER_1 !="Request" | eval Month=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25B") | eval Year=strftime(strptime(SOLVEDDATE,"%25Y-%25m-%25d"),"%25Y") | stats count by GROUP 

Thanks

View solution in original post

Thanks for your response . Yes ur right .. I need to encode .. Is there any specific link for it .. So i can go through it and complete my query . Because i need to change in many palces ..

0 Karma

SplunkTrust
SplunkTrust

Hi @shankarananth,
Please use https://www.urlencoder.org/ for encoding & decoding.

Can you please accept the answer and If you got your answer? It will help community.

Happy Splunking

0 Karma

@kamlesh_vaghela -- Thank you for your help ..
Happy Splunking 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!