All Apps and Add-ons

Sideview Tabs & PostProcess

cramasta
Builder

Hi Sideview,

I have a SavedSearch that I then PostProcess (for deduping values). I then pass these values to the tabs module. Using tabs it seems to ignore the postprocess deduping and lists the values multiple times in the tabs. If i switch from tabs module to checkboxes module it uses the postprocessed deduped values and only creates one checkbox per value.

Is that expected behavior ATM for the tabs module?

Thanks
J

1 Solution

sideview
SplunkTrust
SplunkTrust

Ah! No. It's a bug in Tabs. I'll get it fixed in next maintenance release, and there's an easy workaround detailed below.

First, some background:

The expected behavior of Tabs with respect to postprocess, when configured to render one or more dynamic tabs, is as follows:

1) any upstream postprocess search, (eg those implemented with a PostProcess module), should be used automatically when the module gets search results to render its options (in this case its tabs).
2) when configured with <param name="postProcess">, you can set your own postProcess string here in the module itself rather than having to insert an extra PostProcess module. This postProcess param will do $foo$ substitution on any $foo$ tokens you set therein.
3) If in your postProcess param, you want to pick up an existing postprocess search from an upstream PostProcess module, you can use the token $postProcess$ in your postProcess param

The problem with Tabs, is that #1 doesn't work. Note that #1 does actually work for the other "cousins" ie Pulldown, Checkboxes and Radio modules. It's just the Tabs module that suffers this problem.

This is easy to fix and I'll get it fixed in the next maintenance release. Thanks very much for bringing it to my attention!

WORKAROUND:

this workaround looks a little lame, but it'll work just fine and it'll continue working even after I make the fix in the next maintenance release. That is to put this param in the Tabs module:

<param name="postProcess">$postProcess$</param>

You're basically relying on #2 and #3 to do the job of #1.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Ah! No. It's a bug in Tabs. I'll get it fixed in next maintenance release, and there's an easy workaround detailed below.

First, some background:

The expected behavior of Tabs with respect to postprocess, when configured to render one or more dynamic tabs, is as follows:

1) any upstream postprocess search, (eg those implemented with a PostProcess module), should be used automatically when the module gets search results to render its options (in this case its tabs).
2) when configured with <param name="postProcess">, you can set your own postProcess string here in the module itself rather than having to insert an extra PostProcess module. This postProcess param will do $foo$ substitution on any $foo$ tokens you set therein.
3) If in your postProcess param, you want to pick up an existing postprocess search from an upstream PostProcess module, you can use the token $postProcess$ in your postProcess param

The problem with Tabs, is that #1 doesn't work. Note that #1 does actually work for the other "cousins" ie Pulldown, Checkboxes and Radio modules. It's just the Tabs module that suffers this problem.

This is easy to fix and I'll get it fixed in the next maintenance release. Thanks very much for bringing it to my attention!

WORKAROUND:

this workaround looks a little lame, but it'll work just fine and it'll continue working even after I make the fix in the next maintenance release. That is to put this param in the Tabs module:

<param name="postProcess">$postProcess$</param>

You're basically relying on #2 and #3 to do the job of #1.

sideview
SplunkTrust
SplunkTrust

by the way the underlying bug is now fixed and it'll go out in the next release, probably numbered 2.6.4, probably releasing next week or maybe the week after.

0 Karma

cramasta
Builder

Worked like a charm. Thanks again!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...