topic Re: HiddenPostProcess - export of results in Reporting

HiddenPostProcess - export of results

intachur — Thu, 12 Jan 2012 15:01:46 GMT

Hi all,

I created the set of views where I use HiddenSavedSearch module along with HiddenPostProcess module. HiddenPostProcess does an additional filtering and formatting and the result of transformation is shown using SimpleResultsTable module.

Now I need to export to CSV of the result from SimpleResultsTable. I've tried to use Export module but it provides me the the result of HiddenSavedSearch than I wanted to have in CSV the result of transformation by HiddenPostProcess.

Can anybody give me any hint how it can be done? Thanks in advance.
Sergey

Re: HiddenPostProcess - export of results

araitz — Thu, 12 Jan 2012 17:26:24 GMT

As you have discovered, you cannot export the results of a HiddenPostProcess search. I would recommend making your HiddenSavedSearch do all the necessary filtering and transforming.

Re: HiddenPostProcess - export of results

intachur — Thu, 12 Jan 2012 18:46:44 GMT

Ok, but can I create a link to flash timeline combining my hidden saved search and additional rules from postprocess module?

Re: HiddenPostProcess - export of results

araitz — Thu, 12 Jan 2012 21:11:35 GMT

No, as that is not how HiddenPostProcess is designed to work. Is there a specific reason you can't just use one search to perfom this task?

Re: HiddenPostProcess - export of results

intachur — Fri, 13 Jan 2012 19:33:53 GMT

Just I have more then one post processing to generate different charts with tables

Re: HiddenPostProcess - export of results

araitz — Fri, 13 Jan 2012 19:47:04 GMT

I understand. There are two things you can do:

1) use a HiddenSearch and ViewRedirectorLink below the HiddenPostProcess to redirect to a different view, using the HiddenSearch to specify the full search (original search + post process). The search will have to run again in the new view before the results are exportable.

2) convert each search + post process to be a distinct search that includes the base search + the post process string. While you won't get the benefits of post process, you should be able to export the events and the speed shouldn't be that much worse.

Re: HiddenPostProcess - export of results

iKate — Wed, 11 Jul 2012 10:32:20 GMT

@araitz It would be appreciated greatly if splunk has someday possibility to export exaclty HiddenPostProcess results and not results of a parent search.

And at the moment it would be reasonable to mention this constraints in documentation.

Re: HiddenPostProcess - export of results

araitz — Thu, 12 Jul 2012 04:00:24 GMT

Noted, I opened docs issue SPL-53514 to make note of this in our docs. I will do my best to find a way to export HiddenPostProcess results, but due to the way that post process works, I am not sure this would be easy.

Re: HiddenPostProcess - export of results

Ayn — Tue, 30 Oct 2012 07:30:42 GMT

Just wanted to add a "me too" to this one. I hit this issue yesterday and while there are workarounds like simply not using post processing, that takes away the whole benefit of using it in dashboard panels whose results should be possible to export.

Re: HiddenPostProcess - export of results

sideview — Tue, 24 Dec 2013 21:12:38 GMT

Sideview Utils 3.0 released today, and at least if you're writing Sideview-style views and you're using the Sideview SearchControls module, exports using that module do now take postProcess searches into account.

http://sideviewapps.com/apps/sideview-utils/