Dashboards & Visualizations

v6.0.5: Hide HiddenSearch module when it is used to power HiddenPostProcess modules?

the_wolverine
Champion

I have a HiddenSearch that is populating multiple HiddenPostProcess modules downstream. How can I hide the HiddenSearch module since I am using the HiddenPostProcess modules to populate the panels?

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

It's been a while since I've used those, but I remember the approach being something like this (imagine correct AdvancedXML syntax around this):

...
HiddenSearch, layoutPanel="panel_row1_col1"
  HiddenPostProcess
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row1_col1"
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row2_col1"
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row3_col1"
    Visualization
  /HiddenPostProcess
/HiddenSearch

The HiddenSearch technically is part of the 1x1 panel, but doesn't display anything really. You should also be able to set the layoutPanel for the first HPP to 1x1 and have the HiddenSearch run in the viewHeader or whereever... it just needs a valid panel to "be" in, despite not displaying a lot.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

It's been a while since I've used those, but I remember the approach being something like this (imagine correct AdvancedXML syntax around this):

...
HiddenSearch, layoutPanel="panel_row1_col1"
  HiddenPostProcess
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row1_col1"
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row2_col1"
    Visualization
  /HiddenPostProcess
  HiddenPostProcess layoutPanel="panel_row3_col1"
    Visualization
  /HiddenPostProcess
/HiddenSearch

The HiddenSearch technically is part of the 1x1 panel, but doesn't display anything really. You should also be able to set the layoutPanel for the first HPP to 1x1 and have the HiddenSearch run in the viewHeader or whereever... it just needs a valid panel to "be" in, despite not displaying a lot.

martin_mueller
SplunkTrust
SplunkTrust

Could you explain that a little more? Maybe it's just the .conf aftermath messing with my head...

0 Karma

ben_leung
Builder

So changing the layoutPanel for the HiddenSearch to a a valid value (e.g. viewHeader) will mask the panel from display.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Great... can I mark this as answered then?

0 Karma

the_wolverine
Champion

Yes, that worked martin. Thank you!

0 Karma

sowings
Splunk Employee
Splunk Employee

Just don't give it any visualization, nor a layoutPanel attribute.

0 Karma

the_wolverine
Champion

I got "Misconfigured view '_test' - layoutPanel is not defined for module HiddenSearch. " AND, the view would not load (produced an error and no UI).

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...