Dashboards & Visualizations

Can I use a value from SearchSelectLister in a HiddenPostProcess?


I currently have two SearchSelectLister modules. When I use the HiddenSearch module, I can use the values from the SearchSelectLister modules in my search without a problem ($testId$ and $runId$). I realized that I while I want to use both in various charts in the view, I don't always want both. I can't seem to use $testId$ or $runId$ in HiddenPostProcess searches the way I can in HiddenSearch.

I also took a look at web_access.log, and given the URL that represents that HiddenPostProcess, I think that I'll need to take another approach. Is there way to get the data for many charts using HiddenPostProcess and the $fields$ I've captured with user inputs, or is searching by *(or something general enough) and then post processing with fields not the way to go?

Tags (1)


No unfortunately you can not. There arent even any tricks that would allow you do to it, short of writing a bunch of custom JS in application.js or trying to develop your own module.

However there is an app that I develop called sideview_utils, and what it brings into the picture is about 8 custom modules that you can use instead of the core UI modules.

So when that app is installed locally, instead of using SearchSelectLister and StaticSelect you can use a Sideview module called Pulldown, and instead of using HiddenPostProcess you can just use a module called PostProcess. Likewise instead of HiddenSearch there's just a 'Search' module, and FieldSearch, ExtendedFieldSearch and TextInput can all be replaced with a simpler consistent module called TextField

And in that set of modules (about 8 in all), among other benefits:

a) you dont use intentions at all; $foo$ tokens can just be plugged directly into searches or practically anywhere else.

b) 'practically anywhere else' includes the searches specified by PostProcess modules.

So I would check out the sideview_utils app. It has many example views each with embedded documentation and examples. Granted I'm a little biased. 😃



I believe the answer is no. If you have a similar question, please read: http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess

Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...