topic Re: PostProcess ViewRedirectorLink in Dashboards & Visualizations

PostProcess ViewRedirectorLink

ashishrathore — Mon, 28 Sep 2020 14:38:00 GMT

Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:

Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"

My PostProcess ViewRedirectorLink

*
2
False

index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status
-6h
now

| stats sum(totalBytes) as totalBytes by file | sort - totalBytes

5

flashtimeline
true

| stats sum(count) as count by status | sort - count

flashtimeline
true

Re: PostProcess ViewRedirectorLink

ashishrathore — Mon, 26 Aug 2013 02:31:03 GMT

Can somebody answer if this is even possible in postprocess in Yes or NO?

Re: PostProcess ViewRedirectorLink

joebensimo — Wed, 28 Aug 2013 07:16:48 GMT

I have this same issue. Is there any way to get the full and final query, including post processing?

Re: PostProcess ViewRedirectorLink

sbsbb — Wed, 28 Aug 2013 07:56:45 GMT

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace