Splunk Search

Is that possible to use HiddenPostProcess work with SearchBar module ?

leo_wang
Path Finder

As title.

I want to design a search page that showing the search results ( like flashtimeline ) and one or two statistics charts together for that search results, which need the HiddenPostProcess module after the SearchBar module to process the result data .

I have tried it, but It seems that HiddenPostProcess can't work with SearchBar module, or maybe I had done something wrong...... Any idea ?

Leo Wang

sideview
SplunkTrust
SplunkTrust

It can definitely be done. You just have to nest HiddenPostProcess within SearchBar and your ResultsTable within the HiddenPostProcess.

Here's a pretty simple example:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Simple Search Demo</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">All time</param>
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="label">Restart Search</param>
        <param name="allowSoftSubmit">True</param>

        <module name="HiddenPostProcess" layoutPanel="resultsAreaLeft>
          <param name="search">search user=* group=wheel</param>
          <module name="SimpleResultsTable">
          </module>

          </module>
        </module>
      </module>
    </module>
  </module>
</view>

what you will not be able to do (without writing some complex code in application.js), is have the Paginator work correctly with the postprocess-filtered data. And the counts in ResultsHeader and SimpleResultsHeader will also not account for the filtering.

But FlashChart, SingleValue, SimpleResultsTable, EventsViewer -- all the main rendering modules will work just fine.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...