HiddenPostProcess - export of results

[intachur]

Hi all,

I created the set of views where I use HiddenSavedSearch module along with HiddenPostProcess module. HiddenPostProcess does an additional filtering and formatting and the result of transformation is shown using SimpleResultsTable module.

Now I need to export to CSV of the result from SimpleResultsTable. I've tried to use Export module but it provides me the the result of HiddenSavedSearch than I wanted to have in CSV the result of transformation by HiddenPostProcess.

Can anybody give me any hint how it can be done? Thanks in advance.
Sergey

[sideview]

Sideview Utils 3.0 released today, and at least if you're writing Sideview-style views and you're using the Sideview SearchControls module, exports using that module do now take postProcess searches into account.

http://sideviewapps.com/apps/sideview-utils/

[araitz · Accepted solution]

As you have discovered, you cannot export the results of a HiddenPostProcess search. I would recommend making your HiddenSavedSearch do all the necessary filtering and transforming.

[Ayn]

Just wanted to add a "me too" to this one. I hit this issue yesterday and while there are workarounds like simply not using post processing, that takes away the whole benefit of using it in dashboard panels whose results should be possible to export.

[araitz]

Noted, I opened docs issue SPL-53514 to make note of this in our docs. I will do my best to find a way to export HiddenPostProcess results, but due to the way that post process works, I am not sure this would be easy.

[iKate]

@araitz It would be appreciated greatly if splunk has someday possibility to export exaclty HiddenPostProcess results and not results of a parent search.

And at the moment it would be reasonable to mention this constraints in documentation.

[araitz]

I understand. There are two things you can do:

1) use a HiddenSearch and ViewRedirectorLink below the HiddenPostProcess to redirect to a different view, using the HiddenSearch to specify the full search (original search + post process). The search will have to run again in the new view before the results are exportable.

2) convert each search + post process to be a distinct search that includes the base search + the post process string. While you won't get the benefits of post process, you should be able to export the events and the speed shouldn't be that much worse.

[intachur]

Just I have more then one post processing to generate different charts with tables

[araitz]

No, as that is not how HiddenPostProcess is designed to work. Is there a specific reason you can't just use one search to perfom this task?

[intachur]

Ok, but can I create a link to flash timeline combining my hidden saved search and additional rules from postprocess module?