Dashboards & Visualizations
Highlighted

Can I use a value from SearchSelectLister in a HiddenPostProcess?

Explorer

I currently have two SearchSelectLister modules. When I use the HiddenSearch module, I can use the values from the SearchSelectLister modules in my search without a problem ($testId$ and $runId$). I realized that I while I want to use both in various charts in the view, I don't always want both. I can't seem to use $testId$ or $runId$ in HiddenPostProcess searches the way I can in HiddenSearch.

I also took a look at web_access.log, and given the URL that represents that HiddenPostProcess, I think that I'll need to take another approach. Is there way to get the data for many charts using HiddenPostProcess and the $fields$ I've captured with user inputs, or is searching by *(or something general enough) and then post processing with fields not the way to go?

Tags (1)
Highlighted

Re: Can I use a value from SearchSelectLister in a HiddenPostProcess?

Explorer

I believe the answer is no. If you have a similar question, please read: http://www.splunk.com/base/Documentation/4.1.5/Developer/PostProcess

Highlighted

Re: Can I use a value from SearchSelectLister in a HiddenPostProcess?

SplunkTrust
SplunkTrust

No unfortunately you can not. There arent even any tricks that would allow you do to it, short of writing a bunch of custom JS in application.js or trying to develop your own module.

However there is an app that I develop called sideview_utils, and what it brings into the picture is about 8 custom modules that you can use instead of the core UI modules.

So when that app is installed locally, instead of using SearchSelectLister and StaticSelect you can use a Sideview module called Pulldown, and instead of using HiddenPostProcess you can just use a module called PostProcess. Likewise instead of HiddenSearch there's just a 'Search' module, and FieldSearch, ExtendedFieldSearch and TextInput can all be replaced with a simpler consistent module called TextField

And in that set of modules (about 8 in all), among other benefits:

a) you dont use intentions at all; $foo$ tokens can just be plugged directly into searches or practically anywhere else.

b) 'practically anywhere else' includes the searches specified by PostProcess modules.

So I would check out the sideview_utils app. It has many example views each with embedded documentation and examples. Granted I'm a little biased. 😃

http://splunkbase.splunk.com/apps/All/4.x/App/app:Sideview+Utils

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.