I'm working on a dashboard, and trying to configure a drill down with a custom search. If the custom search contains the rex command, which includes several special characters including ?, <, >, then the drill down doesn't work. When clicking on a row in the dashboard to drill down, a new tab opens in chrome that just says about: blank, instead of opening a new tab with the Splunk search in it.
Steps to reproduce the issue
1) Create a test dashboard using the following simple XML:
<label>dashboard test 1</label>
<row>
<panel>
<table>
<search>
<query>index=wineventlog | head 10 | stats count by host</query>
<earliest>-60m@m</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
</table>
</panel>
</row>
2) Configure the drilldown. Choose Link to search > Custom, and paste in the following query. Save everything.
index=wineventlog host=$row.host$
| head 10
| rex field=Message "Domain:(?<domain>.*)"
| table domain
Note: Here is the simple XML this creates for me
<option name="drilldown">cell</option>
<drilldown>
<link target="_blank">search?q=index=wineventlog host=$row.host$
| head 10
| rex field=Message "Domain:(?<domain>.*)"
| table domain&earliest=&latest=</link>
</drilldown>
3) Click on a row in the dashboard, and observe a new tab opening that just says about:blank.
4) Go back and edit the drill down, and now enter the following query (I know the rex command isn't fully correct here!)
index=wineventlog host=$row.host$
| head 10
| rex field=Message "Domain:(domain.*)"
| table domain
5) Again click on a row in the dashboard, and this time observe that a tab opens up with the splunk search.
Note that obviously there is an issue with the rex command; it doesn't have everything it needs. However, my point in showing this is to provide evidence that the problem can be narrowed down to the ?, <, or > characters causing the issue where just a blank tab opens up in the browser.
Why can't I configure a drill down, and in the custom search use the rex command with the ?, <, and > characters? Is there a way to get this to work?
... View more