Dashboards & Visualizations

PostProcess ViewRedirectorLink

ashishrathore
Explorer

Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:

Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"







*
2
False



index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status
-6h
now

| stats sum(totalBytes) as totalBytes by file | sort - totalBytes

5



flashtimeline
true



| stats sum(count) as count by status | sort - count


flashtimeline
true




1 Solution

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

View solution in original post

0 Karma

sbsbb
Builder

If I'm undestanding the need, I think I had the same Problem, and I made the following :

(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search

<module name="HTML">
  <param name="html"><![CDATA[
    <a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
    <a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
  ]]></param>
</module>

In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string

I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace

0 Karma

joebensimo
Path Finder

I have this same issue. Is there any way to get the full and final query, including post processing?

0 Karma

ashishrathore
Explorer

Can somebody answer if this is even possible in postprocess in Yes or NO?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...