I have a search table that lists user ids in the form of [domain][userid] and a numeric value. There is a drilldown set on the user id that opens a new search where the user id becomes the search value. The problem is that when the new search opens I have to manually replace the single '\' with '\' so the search will run.
Drilldown search looks like this:
index="pan" user="$row.user$" | stats count by http_category | sort -count
Where $row.user$ is the carried forward value (eg uni\3333333) and is what I have to manually correct to uni\3333333.
Is there a way that I can have this manual correction made automatically as part of the drilldown search string.
Cheers
Hello @balcv,
I suppose your drilldown looks like this:
<table>
<search>
...
</search>
<drilldown>
<link target="_blank">search?q=index=pan%20user=%22$row.user$%22</link>
</drilldown>
You can use eval expressions in drilldowns. Here is a similar question: How do you use eval in XML drilldown?
So this should work:
<drilldown>
<eval token="usertoken">replace($row.user$,"\\\\","\\\\")</eval>
<link target="_blank">search?q=index=pan%20user=%22$usertoken$%22</link>
</drilldown>
The additional backslashes in the replace function are required for escaping the actual backslashes.
Hello @balcv,
I suppose your drilldown looks like this:
<table>
<search>
...
</search>
<drilldown>
<link target="_blank">search?q=index=pan%20user=%22$row.user$%22</link>
</drilldown>
You can use eval expressions in drilldowns. Here is a similar question: How do you use eval in XML drilldown?
So this should work:
<drilldown>
<eval token="usertoken">replace($row.user$,"\\\\","\\\\")</eval>
<link target="_blank">search?q=index=pan%20user=%22$usertoken$%22</link>
</drilldown>
The additional backslashes in the replace function are required for escaping the actual backslashes.
Perfect. Thank you. I did have to make one alteration to the code you provided and that was replace the %22 and %20 with the actual characters, but other than that, this is exactly what I needed.