Dashboards & Visualizations

Can I use a value from SearchSelectLister in a HiddenPostProcess?


I currently have two SearchSelectLister modules. When I use the HiddenSearch module, I can use the values from the SearchSelectLister modules in my search without a problem ($testId$ and $runId$). I realized that I while I want to use both in various charts in the view, I don't always want both. I can't seem to use $testId$ or $runId$ in HiddenPostProcess searches the way I can in HiddenSearch.

I also took a look at web_access.log, and given the URL that represents that HiddenPostProcess, I think that I'll need to take another approach. Is there way to get the data for many charts using HiddenPostProcess and the $fields$ I've captured with user inputs, or is searching by *(or something general enough) and then post processing with fields not the way to go?

Tags (1)


No unfortunately you can not. There arent even any tricks that would allow you do to it, short of writing a bunch of custom JS in application.js or trying to develop your own module.

However there is an app that I develop called sideview_utils, and what it brings into the picture is about 8 custom modules that you can use instead of the core UI modules.

So when that app is installed locally, instead of using SearchSelectLister and StaticSelect you can use a Sideview module called Pulldown, and instead of using HiddenPostProcess you can just use a module called PostProcess. Likewise instead of HiddenSearch there's just a 'Search' module, and FieldSearch, ExtendedFieldSearch and TextInput can all be replaced with a simpler consistent module called TextField

And in that set of modules (about 8 in all), among other benefits:

a) you dont use intentions at all; $foo$ tokens can just be plugged directly into searches or practically anywhere else.

b) 'practically anywhere else' includes the searches specified by PostProcess modules.

So I would check out the sideview_utils app. It has many example views each with embedded documentation and examples. Granted I'm a little biased. 😃



I believe the answer is no. If you have a similar question, please read: http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess

Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...