Dashboards & Visualizations

PostProcess ViewRedirectorLink

ashishrathore
Explorer

Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:

Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"







*
2
False



index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status
-6h
now

| stats sum(totalBytes) as totalBytes by file | sort - totalBytes

5



flashtimeline
true



| stats sum(count) as count by status | sort - count


flashtimeline
true




1 Solution

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

View solution in original post

0 Karma

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

0 Karma

joebensimo
Path Finder

I have this same issue. Is there any way to get the full and final query, including post processing?

0 Karma

ashishrathore
Explorer

Can somebody answer if this is even possible in postprocess in Yes or NO?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...