Export different fields from what is shown in the Table module

[cmak]

I show a Table module, and allow users to export the search contents in 1 search.
For example, my search includes

table field1, fields2, fields3, fields4

I want my table to show only field 1 and fields 2.
I want the exported data to show only field 3 and field4.

I can get the table to do what I want (hide field 3 and 4) by simply using the hiddenFields param.

<param name="hiddenFields">field3 field4</param>

However, I was wondering if I could limit the fields for export

[sideview · Accepted solution]

Well the normal reaction here might be to try using postProcess, possibly wrapping the SearchControls module in a PostProcess module. However while the Sideview SearchControls module implements an export button, it's really just a thin wrapper around Splunk's Export functionality, and unfortunately in the end the exported results are totally unaffected by any postProcess search.

I'll add this to my list of improvements to explore. It would certainly nice to have export still use a given set of search results, but transform it at the last second while it's on its way out.

So to sum up, I think the only way is to submit a whole second search in parallel with the one you're displaying, use the same $foo$ tokens in both, but have the second search hooked up with the SearchControls module, and the first one hooked up to the Table.