topic Re: Issue with Postprocessing in Dashboards & Visualizations

Issue with Postprocessing

theouhuios — Thu, 18 Oct 2012 15:59:28 GMT

Hello

I am trying to use postprocessing and having issues with it. Can anyone please help me out in understanding where am I going wrong here.

<?xml version='1.0' encoding='utf-8'?>

Service Operation - Outages and Notification Dashboard sourcetype="incident" record.groupDepartment="*" record.groupArea="*" record.assignmentGroup="*"| dedup record.incidentId|timechart span=1hr count by record.eventType usenull=f | addtotals create , update | fields - create , update

Department: * All Systems Agency Area: * All Architecture and Engineering Systems Technology Product Solutions Systems Projects Customer Connection Solutions Channel Support General and Financial Services Data and amp; Information Strategies P and amp;C Claims Systems Customer Relationship Management Not Defined Product Solutions WorkGroup: *

24 Hour History earliest=-24h@h latest=@h | search record.groupDepartment="$Dept$" record.groupArea="$Area$" record.assignmentGroup="$WG$" Time column gaps stacked false right 20 true all 31 day History earliest=-31d@d latest=@d | search record.groupDepartment="$Dept$" record.groupArea="$Area$" record.assignmentGroup="$WG$" Time column stacked 10 true

Regards

theou

Re: Issue with Postprocessing

jonuwz — Thu, 18 Oct 2012 19:58:38 GMT

You cant use values generated from selectors / intentions in post process.

Its a limitation, and the bane of my life.

sideview utils works around this - its a cool app.

Re: Issue with Postprocessing

sideview — Thu, 18 Oct 2012 20:59:30 GMT

Yep. Sideview Utils fills a lot of gaps like this. In this particular case it has PostProcess module to replace HiddenPostProcess. Not only can you do $foo$ substitution into PostProcess searches, but you don't have to think about intentions at all ever again -- the substitution is right from the raw tokens into the $foo$. No intention middleman. Also the Pulldown and TextField modules are much easier to use than the core equivalents. remember to get the latest version (2.2.2) from the Sideview site. The version on Splunkbase is actually quite old.