Dashboards & Visualizations

Drilldown - Passing along equals (=) and quotes (") in parameter values

jamesvz84
Communicator

Hello,

I am using SideView Utils (but am open to pure advanced xml solutions as well). I have a problem where I have a multi-dropdown on one page, and want to drilldown into another page. This works fine when I have one selection and no quotes in the token. But when there is more than one selection, then I need to use a Pulldown template to build the OR string, which requires the token to contain equals sign(s) (Example: $application$ template value may be... application=value1 OR application=value2). Also, I need to put quotes around the $value$ token in order to account for spaces in the values. Both the equal signs and quotes are getting encoded in the URL string (equals is changed to %3D and quote to %22) and the page I am drilling into does not capture the values correctly.

Is there some way to overcome this so that the tokens can get passed along with = and " inside the value and the target page reads them correctly?

0 Karma

jamesvz84
Communicator

Disregard,

Upon inspection of the search, there was another issue in the query. The characters = and " actually DID decode automatically.

0 Karma

sideview
SplunkTrust
SplunkTrust

One high level piece of advice - is that whenever you're passing values in querystring args, it is recommended to always use the foo.rawValue tokens rather than the $foo$ token itself. This convention takes a little getting used to, but it's a very good thing in the long run.

Granted, if you're just plugging it into the search language ont the target page and doing nothing else with it, what you're doing is exactly right.

Also if you need to reconstitute the raw array-valued token back into a search expression on the target page, the ArrayValueSetter module can do that for you.

0 Karma

jamesvz84
Communicator

The problem I see is performing the replacement before my search string needs it. I'd rather not use eval + search to do this, because first I'd have to pipe a large dataset then replace the characters in the values then actually search for the updated values. Unless there is another way to do this that I am not thinking of...

0 Karma

somesoni2
Revered Legend

How about replacing the values at target page for "%3D" with = and %22 with space before using them?

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...