Dashboards & Visualizations

Drilldown - Passing along equals (=) and quotes (") in parameter values

jamesvz84
Communicator

Hello,

I am using SideView Utils (but am open to pure advanced xml solutions as well). I have a problem where I have a multi-dropdown on one page, and want to drilldown into another page. This works fine when I have one selection and no quotes in the token. But when there is more than one selection, then I need to use a Pulldown template to build the OR string, which requires the token to contain equals sign(s) (Example: $application$ template value may be... application=value1 OR application=value2). Also, I need to put quotes around the $value$ token in order to account for spaces in the values. Both the equal signs and quotes are getting encoded in the URL string (equals is changed to %3D and quote to %22) and the page I am drilling into does not capture the values correctly.

Is there some way to overcome this so that the tokens can get passed along with = and " inside the value and the target page reads them correctly?

0 Karma

jamesvz84
Communicator

Disregard,

Upon inspection of the search, there was another issue in the query. The characters = and " actually DID decode automatically.

0 Karma

sideview
SplunkTrust
SplunkTrust

One high level piece of advice - is that whenever you're passing values in querystring args, it is recommended to always use the foo.rawValue tokens rather than the $foo$ token itself. This convention takes a little getting used to, but it's a very good thing in the long run.

Granted, if you're just plugging it into the search language ont the target page and doing nothing else with it, what you're doing is exactly right.

Also if you need to reconstitute the raw array-valued token back into a search expression on the target page, the ArrayValueSetter module can do that for you.

0 Karma

jamesvz84
Communicator

The problem I see is performing the replacement before my search string needs it. I'd rather not use eval + search to do this, because first I'd have to pipe a large dataset then replace the characters in the values then actually search for the updated values. Unless there is another way to do this that I am not thinking of...

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about replacing the values at target page for "%3D" with = and %22 with space before using them?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...