Splunk Search

my search string is truncated after a question mark in a custom drilldown search


my search string is truncated after a question mark in a custom drilldown search.

I have a statistic table that I made in a dashboard, and when I click in the row of that table, I have custom search.

so I go to Edit Drilldown -> Link to search and I choose custom.

the problem is: I am using regular expression in my custom search and when I click in the table row, it takes me to the new custom search but everything after the regular expression question mark is truncated.

here is my custome search:

host="myhost"   field1=$row.id$ 
|rex "\|mynewField:(?<newField>.*)\|"

however when I click and go to the custom search, the search appears is :

host="myhost"   field1=$row.id$ 
|rex "\|mynewField:(

so basically the question mark ?, and everything after is truncated. and I get Unbalanced quotes error

0 Karma

Super Champion

hey seems like it is URL encoding problem

edit your XML custom search as

          <link target="_blank">search?q=host="myhost"   field1=$row.id$ 
 |rex "\|mynewField:(%3F&lt;newField&gt;.*)\|"</link>

let me know if this helps!

Super Champion

If you deem a posted answer as valid and helpful to your solving of the issue, please accept said answer so that this question no longer appears open.

0 Karma


Try replacing the question mark with its URL-encoded equivalent %3F.

If this reply helps you, Karma would be appreciated.


Hi sabirmgd,

Could you share XML in 101010 editor?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...