Knowledge Management

Is it possible to use macro in post process?

ma_anand1984
Contributor

Hi all,

Is it possible to use macro in post process?

Anand

Tags (2)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

Yes it is. Here is an example:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="foo" autoRun="True">
  <param name="groupLabel">foo</param>
  <param name="search">index=_internal | head 5</param>
    <module name="HiddenPostProcess">
      <param name="search">`head`</param>
      <module name="JobProgressIndicator"/>
      <module name="Paginator">
        <param name="count">10</param>
        <param name="entityName">results</param>
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="SimpleResultsTable">
            <param name="allowTransformedFieldSelect">True</param>
            <param name="entityName">results</param>
            <param name="drilldown">row</param>
            <module name="Gimp"/>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>

View solution in original post

melting
Splunk Employee
Splunk Employee

Yes it is. Here is an example:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="foo" autoRun="True">
  <param name="groupLabel">foo</param>
  <param name="search">index=_internal | head 5</param>
    <module name="HiddenPostProcess">
      <param name="search">`head`</param>
      <module name="JobProgressIndicator"/>
      <module name="Paginator">
        <param name="count">10</param>
        <param name="entityName">results</param>
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="SimpleResultsTable">
            <param name="allowTransformedFieldSelect">True</param>
            <param name="entityName">results</param>
            <param name="drilldown">row</param>
            <module name="Gimp"/>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>

Ayn
Legend

Yes, it is.

ma_anand1984
Contributor

is it possible in saved search as well ?

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...