Eval varible doesnt work at drilldown xml

[kennethyeung]

       <eval token="t_contract">=strftime(now(), "%y%m")</eval>
      <link > <![CDATA[
      /app/search/option_change?form.tok_contract=$t_contract$
      ]]>
      </link>
    </drilldown>

it will go to anotherview but the link " /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m")
seem that it dont know process before pass to link
also tried use " to quote in the URL, also not work.

Thanks

[elliotproebstel]

I'm pretty sure the issue is the = in your eval statement.

<eval token="t_contract">=strftime(now(), "%y%m")</eval>
should actually be
<eval token="t_contract">strftime(now(), "%y%m")</eval>

In the link: /app/search/option_change?form.tok_contract=%3Dstrftime(now()%2C "%25y%25m") the %3D between contract= and strftime is ASCII encoding for =.

[kennethyeung]

Thanks, i miss i have more = sign .

[harsmarvania57 · Accepted solution]

Hi @kennethyeung

I have tried below drilldown and it's working fine.

        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>

Sample dashboard with drilldown working fine, in below dashboard I have another dashboard called test1 and that dashboard has Text Input field with token name test1token so when I redirect to another dashboard I got value 1712 in text input.

<form>
  <label>test</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="multiselect" token="field1" searchWhenChanged="false">
      <label>field1</label>
      <choice value="sourcetype">Sourcetype</choice>
      <search>
        <query/>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
      <delimiter> </delimiter>
    </input>
    <input type="multiselect" token="field2">
      <label>field2</label>
      <choice value="host">Host</choice>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal | stats count by $field1$, $field2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <drilldown>
          <eval token="t_contract">strftime(now(), "%y%m")</eval>
                 <link > <![CDATA[
       /app/search/test1?form.test1token=$t_contract$
       ]]>
       </link>
        </drilldown>
      </table>
    </panel>
  </row>
</form>

[kennethyeung]

Is it related version issue?
I am using 7.0 and free version

[harsmarvania57]

Let me try in Splunk 7, above code was test in Splunk 6.6

[harsmarvania57]

Working perfectly fine in Splunk 7.0.1, please check again my drilldown code I have already removed =before strftime

[kennethyeung]

Thanks, i miss i have more = sign .

[kamlesh_vaghela]

HI @kennethyeung,

Can you please try to display form.tok_contract value in option_change dashboard? It is what you expected?

just add.

<row>
    <panel>
      <title>$form.tok_contract$</title>
    </panel>
</row>