Dashboards & Visualizations

Can I use a value from SearchSelectLister in a HiddenPostProcess?


I currently have two SearchSelectLister modules. When I use the HiddenSearch module, I can use the values from the SearchSelectLister modules in my search without a problem ($testId$ and $runId$). I realized that I while I want to use both in various charts in the view, I don't always want both. I can't seem to use $testId$ or $runId$ in HiddenPostProcess searches the way I can in HiddenSearch.

I also took a look at web_access.log, and given the URL that represents that HiddenPostProcess, I think that I'll need to take another approach. Is there way to get the data for many charts using HiddenPostProcess and the $fields$ I've captured with user inputs, or is searching by *(or something general enough) and then post processing with fields not the way to go?

Tags (1)


No unfortunately you can not. There arent even any tricks that would allow you do to it, short of writing a bunch of custom JS in application.js or trying to develop your own module.

However there is an app that I develop called sideview_utils, and what it brings into the picture is about 8 custom modules that you can use instead of the core UI modules.

So when that app is installed locally, instead of using SearchSelectLister and StaticSelect you can use a Sideview module called Pulldown, and instead of using HiddenPostProcess you can just use a module called PostProcess. Likewise instead of HiddenSearch there's just a 'Search' module, and FieldSearch, ExtendedFieldSearch and TextInput can all be replaced with a simpler consistent module called TextField

And in that set of modules (about 8 in all), among other benefits:

a) you dont use intentions at all; $foo$ tokens can just be plugged directly into searches or practically anywhere else.

b) 'practically anywhere else' includes the searches specified by PostProcess modules.

So I would check out the sideview_utils app. It has many example views each with embedded documentation and examples. Granted I'm a little biased. 😃



I believe the answer is no. If you have a similar question, please read: http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...