Dashboards & Visualizations

PostProcess ViewRedirectorLink

ashishrathore
Explorer

Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:

Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"







*
2
False



index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status
-6h
now

| stats sum(totalBytes) as totalBytes by file | sort - totalBytes

5



flashtimeline
true



| stats sum(count) as count by status | sort - count


flashtimeline
true




1 Solution

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

View solution in original post

0 Karma

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

View solution in original post

0 Karma

joebensimo
Path Finder

I have this same issue. Is there any way to get the full and final query, including post processing?

0 Karma

ashishrathore
Explorer

Can somebody answer if this is even possible in postprocess in Yes or NO?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!