Horizontally grouping modules without extra text/titles?

[ahall_splunk]

I want to be able to group 3 SingleValues modules horizontally, as part of a post-process, so I have:

stats count
Count
count

... repeated three times with different values after the grpX. I want to group these. I've tried module StaticContentSample, that requires a "text" field and always displays some text. I've also tried the GenericHeader, that requires a "label" field and always displays a header.

Is there a way to get the grouping without the associated text/label?

[ahall_splunk · Accepted solution]

Yeah - I thought of that, but that still produces a title based on the "group=" information.

I did find the information, which is to use NullModule

<module name="NullModule" layoutPanel="panel_row2_col1" autoRun="True">
<module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp1" autoRun="True">
...
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row2_col1_grp2" autoRun="True">
...
</module>
</module>

[sideview]

And again you really want to get those extra autoRun="True" attributes out of there. Leave only the topmost one on the NullModule.

[sideview]

just fyi, the "foo" title that comes from modules having group="foo" attributes is not related at all to the "grpN" part of the layoutPanel attributes. Maybe I'm missing something though.

[hazekamp]

We do something similar to this in ESS. You can use the layoutPanel format of "panel_rowX_colY_grpZ".

<module name="HiddenSavedSearch" layoutPanel="panel_row1_col1" autoRun="True" group="Notable Events by ESS Domain">
<param name="savedSearch">ESS - Notable Events by Domain</param>
<param name="useHistory">Auto</param>
<module name="SimpleResultsHeader">
  <param name="entityName">scanned</param>
  <param name="headerFormat">%(count)s events scanned $time$</param>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1_grp1">
  <param name="search">search security_domain=access | `notable_rangemap_access` | eval label="Access: ".count</param>
  <module name="EnablePreview">
    <param name="display">false</param>
    <param name="enable">true</param>
    <module name="SingleValue">
      <param name="field">label</param>
      <param name="classField">range</param>
      <param name="linkSearch">`notable` | search $statusToken$ $urgencyToken$ $securityDomainToken$ $governanceToken$ | search security_domain=access</param>
      <param name="linkView">incident_review</param>
    </module>
  </module>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1_grp2">
  <param name="search">search security_domain=endpoint | `notable_rangemap_endpoint` | eval label="Endpoint: ".count</param>
  <module name="EnablePreview">
    <param name="display">false</param>
    <param name="enable">true</param>
    <module name="SingleValue">
      <param name="field">label</param>
      <param name="classField">range</param>
      <param name="linkSearch">`notable` | search $statusToken$ $urgencyToken$ $securityDomainToken$ $governanceToken$ | search security_domain=endpoint</param>
      <param name="linkView">incident_review</param>
    </module>
  </module>
</module>
<module name="HiddenPostProcess" layoutPanel="panel_row1_col1_grp3">
  <param name="search">search security_domain=network | `notable_rangemap_network` | eval label="Network: ".count</param>
  <module name="EnablePreview">
    <param name="display">false</param>
    <param name="enable">true</param>
    <module name="SingleValue">
      <param name="field">label</param>
      <param name="classField">range</param>
      <param name="linkSearch">`notable` | search $statusToken$ $urgencyToken$ $securityDomainToken$ $governanceToken$ | search security_domain=network</param>
      <param name="linkView">incident_review</param>
    </module>
  </module>
</module>