topic Re: Can I use a value from SearchSelectLister in a HiddenPostProcess? in Dashboards & Visualizations

Can I use a value from SearchSelectLister in a HiddenPostProcess?

brettgladys — Wed, 13 Oct 2010 03:45:06 GMT

I currently have two SearchSelectLister modules. When I use the HiddenSearch module, I can use the values from the SearchSelectLister modules in my search without a problem ($testId$ and $runId$). I realized that I while I want to use both in various charts in the view, I don't always want both. I can't seem to use $testId$ or $runId$ in HiddenPostProcess searches the way I can in HiddenSearch.

I also took a look at web_access.log, and given the URL that represents that HiddenPostProcess, I think that I'll need to take another approach. Is there way to get the data for many charts using HiddenPostProcess and the $fields$ I've captured with user inputs, or is searching by *(or something general enough) and then post processing with fields not the way to go?

Re: Can I use a value from SearchSelectLister in a HiddenPostProcess?

brettgladys — Wed, 13 Oct 2010 21:48:00 GMT

I believe the answer is no. If you have a similar question, please read: http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess

Re: Can I use a value from SearchSelectLister in a HiddenPostProcess?

sideview — Thu, 31 Mar 2011 23:29:35 GMT

No unfortunately you can not. There arent even any tricks that would allow you do to it, short of writing a bunch of custom JS in application.js or trying to develop your own module.

However there is an app that I develop called sideview_utils, and what it brings into the picture is about 8 custom modules that you can use instead of the core UI modules.

So when that app is installed locally, instead of using SearchSelectLister and StaticSelect you can use a Sideview module called Pulldown, and instead of using HiddenPostProcess you can just use a module called PostProcess. Likewise instead of HiddenSearch there's just a 'Search' module, and FieldSearch, ExtendedFieldSearch and TextInput can all be replaced with a simpler consistent module called TextField

And in that set of modules (about 8 in all), among other benefits:

a) you dont use intentions at all; $foo$ tokens can just be plugged directly into searches or practically anywhere else.

b) 'practically anywhere else' includes the searches specified by PostProcess modules.

So I would check out the sideview_utils app. It has many example views each with embedded documentation and examples. Granted I'm a little biased. 😃

http://splunkbase.splunk.com/apps/All/4.x/App/app:Sideview+Utils