Reporting

HiddenPostProcess - export of results

Explorer

Hi all,

I created the set of views where I use HiddenSavedSearch module along with HiddenPostProcess module. HiddenPostProcess does an additional filtering and formatting and the result of transformation is shown using SimpleResultsTable module.

Now I need to export to CSV of the result from SimpleResultsTable. I've tried to use Export module but it provides me the the result of HiddenSavedSearch than I wanted to have in CSV the result of transformation by HiddenPostProcess.

Can anybody give me any hint how it can be done? Thanks in advance.
Sergey

Tags (1)
1 Solution

Splunk Employee
Splunk Employee

As you have discovered, you cannot export the results of a HiddenPostProcess search. I would recommend making your HiddenSavedSearch do all the necessary filtering and transforming.

View solution in original post

SplunkTrust
SplunkTrust

Sideview Utils 3.0 released today, and at least if you're writing Sideview-style views and you're using the Sideview SearchControls module, exports using that module do now take postProcess searches into account.

http://sideviewapps.com/apps/sideview-utils/

0 Karma

Splunk Employee
Splunk Employee

As you have discovered, you cannot export the results of a HiddenPostProcess search. I would recommend making your HiddenSavedSearch do all the necessary filtering and transforming.

View solution in original post

Legend

Just wanted to add a "me too" to this one. I hit this issue yesterday and while there are workarounds like simply not using post processing, that takes away the whole benefit of using it in dashboard panels whose results should be possible to export.

0 Karma

Splunk Employee
Splunk Employee

Noted, I opened docs issue SPL-53514 to make note of this in our docs. I will do my best to find a way to export HiddenPostProcess results, but due to the way that post process works, I am not sure this would be easy.

0 Karma

Builder

@araitz It would be appreciated greatly if splunk has someday possibility to export exaclty HiddenPostProcess results and not results of a parent search.

And at the moment it would be reasonable to mention this constraints in documentation.

0 Karma

Splunk Employee
Splunk Employee

I understand. There are two things you can do:

1) use a HiddenSearch and ViewRedirectorLink below the HiddenPostProcess to redirect to a different view, using the HiddenSearch to specify the full search (original search + post process). The search will have to run again in the new view before the results are exportable.

2) convert each search + post process to be a distinct search that includes the base search + the post process string. While you won't get the benefits of post process, you should be able to export the events and the speed shouldn't be that much worse.

0 Karma

Explorer

Just I have more then one post processing to generate different charts with tables

0 Karma

Splunk Employee
Splunk Employee

No, as that is not how HiddenPostProcess is designed to work. Is there a specific reason you can't just use one search to perfom this task?

0 Karma

Explorer

Ok, but can I create a link to flash timeline combining my hidden saved search and additional rules from postprocess module?

0 Karma