<drilldown>
<link>manual_search-verification?form.index="$index$"&field="$field$"</link>
</drilldown>
I am trying to pass two tokens using a drilldown on a table object.
Splunk will not let me pass two tokens using an & operator (see code) - I get an XML syntax error (says it is expecting [;]... not sure how to implement this)
How should I be writing this query?
Thanks for the help all!
OK I've solved this myself, hope it helps someone else out too...
So instead of using "&" to join the query use "&"
. For example:
<link>view?form.index="$index$"&field="$field$"</link>
NOT:
<link>view?form.index="$index$"&field="$field$"</link>
OK I've solved this myself, hope it helps someone else out too...
So instead of using "&" to join the query use "&"
. For example:
<link>view?form.index="$index$"&field="$field$"</link>
NOT:
<link>view?form.index="$index$"&field="$field$"</link>
Old post, but this helped me out. Thanks for checking back in!
You could also use CDATA to enclose text that you don't want to be processed as XML, like this
<link><![CDATA[view?form.index="$index$"&field="$field$"]]></link>
CDATA block is the way to go I think. Much easier.
Also helpful, thank you!