Export Results from a postProcess

sbsbb — Wed, 03 Jul 2013 13:15:58 GMT

I wonder if it is possible to export results from a PostProcess.
If I use a "SearchControls" object, it can export results, but only from the upstream search, not from the postProcess.

Is there a way to export Data from a Postprocess, or even a Table, in csv and raw format ?

Re: Export Results from a postProcess

sideview — Mon, 28 Sep 2020 14:14:51 GMT

It's possible for this to be implemented in the future but it's not possible right now.

Good News: in the splunkd rest API, the export endpoint now does actually support passing a postprocess search as an argument called "search". You can test this out for yourself.

I ran a search of index=_internal source=*metrics.log | stats count by group series, clicked the export icon in the SearchControls module, tracked that to this in splunkd_access.log:

/servicesNS/admin/sideview_utils/search/jobs/1372868585.20/results/export?output_mode=csv&f=group&f=series&f=count&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z

and then adding a 'search' argument, and hitting the resulting URL manually on the management port:

https://localhost:8089/servicesNS/admin/sideview_utils/search/jobs/1372868585.20/results/export?output_mode=csv&f=group&f=series&f=count&output_time_format=%25Y-%25m-%25dT%25H%3A%25M%3A%25S.%25Q%25z&search=search%20group%3Dper_sourcetype_thruput

and indeed the postprocess search does take effect.

The Bad News: The underlying support for postProcess doesn't go any higher in the code stack than that. When you click the export icon, the Sideview code doesn't talk to splunkd's REST api directly. Instead it talks to a controller in SplunkWeb and it looks like all of that SplunkWeb code fails to pass on the postProcess argument during export (in site-packages/splunk/appserver/mrsparkle/controllers/search.py getJobAsset neglects to pass on all the kwargs if the 'isDownload' flag is set) .

So in short, SearchControls could be modified to support postProcess on export, but I'd have to package a new export controller in Sideview. It can happen and I'll probably do it eventually but it's not a quick fix I'm afraid.

UPDATE:
In Sideview Utils 3.0 the SearchControls module was integrated against a custom controller also contained in Sideview Utils, such that exports from that module do now correctly account for postprocess searches in the view. http://sideviewapps.com/apps/sideview-utils/

Re: Export Results from a postProcess

sbsbb — Thu, 04 Jul 2013 05:50:20 GMT

Many Thanks for your feedback

Re: Export Results from a postProcess

sbsbb — Thu, 04 Jul 2013 05:50:44 GMT

Many Thanks for your feedback

Re: Export Results from a postProcess

ma_anand1984 — Tue, 03 Dec 2013 11:18:15 GMT

@sideview

Let us know if you have a fix in place

Re: Export Results from a postProcess

sideview — Tue, 24 Dec 2013 21:05:20 GMT

Sideview Utils 3.0 released today and the SearchControls module now takes postProcess searches into account when the user exports.

http://sideviewapps.com/apps/sideview-utils/

topic Re: Export Results from a postProcess in All Apps and Add-ons

Export Results from a postProcess

Re: Export Results from a postProcess

Re: Export Results from a postProcess

Re: Export Results from a postProcess

Re: Export Results from a postProcess

Re: Export Results from a postProcess