PostProcess ViewRedirectorLink

[ashishrathore]

Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:

Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"

My PostProcess ViewRedirectorLink

[sbsbb · Accepted solution]

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

[joebensimo]

I have this same issue. Is there any way to get the full and final query, including post processing?

[ashishrathore]

Can somebody answer if this is even possible in postprocess in Yes or NO?