Knowledge Management

Is it possible to use macro in post process?

ma_anand1984
Contributor

Hi all,

Is it possible to use macro in post process?

Anand

Tags (2)
0 Karma
1 Solution

melting
Splunk Employee
Splunk Employee

Yes it is. Here is an example:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="foo" autoRun="True">
  <param name="groupLabel">foo</param>
  <param name="search">index=_internal | head 5</param>
    <module name="HiddenPostProcess">
      <param name="search">`head`</param>
      <module name="JobProgressIndicator"/>
      <module name="Paginator">
        <param name="count">10</param>
        <param name="entityName">results</param>
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="SimpleResultsTable">
            <param name="allowTransformedFieldSelect">True</param>
            <param name="entityName">results</param>
            <param name="drilldown">row</param>
            <module name="Gimp"/>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>

View solution in original post

melting
Splunk Employee
Splunk Employee

Yes it is. Here is an example:

<module name="HiddenSearch" layoutPanel="panel_row1_col1" group="foo" autoRun="True">
  <param name="groupLabel">foo</param>
  <param name="search">index=_internal | head 5</param>
    <module name="HiddenPostProcess">
      <param name="search">`head`</param>
      <module name="JobProgressIndicator"/>
      <module name="Paginator">
        <param name="count">10</param>
        <param name="entityName">results</param>
        <module name="EnablePreview">
          <param name="enable">True</param>
          <param name="display">False</param>
          <module name="SimpleResultsTable">
            <param name="allowTransformedFieldSelect">True</param>
            <param name="entityName">results</param>
            <param name="drilldown">row</param>
            <module name="Gimp"/>
          </module>
          <module name="ViewRedirectorLink">
            <param name="viewTarget">flashtimeline</param>
          </module>
        </module>
      </module>
    </module>
  </module>

Ayn
Legend

Yes, it is.

ma_anand1984
Contributor

is it possible in saved search as well ?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...