All Apps and Add-ons

How do I Paginate search results and PostProcess the paginated results

ahogrefe
Engager

Hi,
I have to create a dashboard that displays results in columns, one column per day. Like:

System | 2015.01.01 | 2015.01.02 | 2015.01.03
A | 4711 | 4712 | 4713
B | 0815 | 0816 | 0817
C | 0815 | 0816 | 0817
D | 0815 | 0816 | 0817
E | 0815 | 0816 | 0817
...
The Cells have to be colored depending on the value. The Pagination has to be n-columns per Page. Number of Days and TimeRange is unknown before the start of the search. My Idea was:
1. Get the results in a row per day
2. Paginate the results
3. Do a PostProcess (Append Rows with format information and transpose the results)
4. Display the Table with paginated days as columns

The Code looks like this:

    <view isSticky="False" isVisible="false" onunloadCancelJobs="true" template="dashboard.html">
       <module name="SideviewUtils" layoutPanel="appHeader">
       </module>

       <module name="URLLoader" layoutPanel="viewHeader" autoRun="True">
          <param name="keepURLUpdated">True</param>
             <module name="SavedSearch" layoutPanel="panel_row2_col1"> 
             <param name="name">
                          The_Search_that_returns_the_Values_with_each_Day_as_a_Row
             </param>
             <module name="JobProgressIndicator">
               <module name="Pager">
                   <param name="count">3</param> 
                        <module name="PostProcess"><param name="search">
| The_Search_that_transposes_the_Table_and_hopefully_enables_column_pagination
                              </param>
                      <module name="Table">
                          <param name="rowClass">   col_02-$row.fields.formatCol_1$
                                                        col_03-$row.fields.formatCol_2$
                                                                                                        [...]
                                  </param>
                                  <param name="hiddenFields">formatCol_1 formatCol_2 [...] </param>
                                  <param name="count">25</param>
                               </module>
                            </module>
                         </module>
                  </module>
                   </module>
              </module> 
        </view>

Works not like supposed, the results of the first search are all transposed and the resulting Table looks like this:

<- 1, 2, 3, ... ->
System | 2015.01.01 | 2015.01.02 | 2015.01.03
A | 4711 | 4712 | 4713
B | 0815 | 0816 | 0817
C | 0815 | 0816 | 0817

I wanted that result:

<- 1, 2, 3, ... ->
System | 2015.01.01 | 2015.01.02
A | 4711 | 4712
B | 0815 | 0816
C | 0815 | 0816
D | 0815 | 0816
E | 0815 | 0816
...

It seems like the Pagination waits untill all search has been finished and then starts to paginate. Also the number of Rows in that table seems to be set by the Pagination. Is there a way to work around this?

Thanx in advance and happy splunking 😉

Cheers!

sideview
SplunkTrust
SplunkTrust

I'm afraid I don't actually think there's a way to do this. Postprocess searches are applied to all of the rows, and although postprocess searches can arbitrarily transform and change the results into some other set of rows, ultimately the pagination is always going to just page row-wise through those rows.

If you could accept a restriction that the number of rows were fixed at some number like 10, then we could hack some of this use case, in that we could use the search language to create "fields" for the first N days on rows 1-10, and then fields starting at 2N-1 for rows 11-20, fields corresponding to the next days starting at row 21 etc. Then when you paged through the rows, the column headers would appear to change.

But as for the broader question of making the "results per page" turn into "columns per page", pagination and postprocess would have to work fundamentally differently to do so.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...