Splunk Search

Is that possible to use HiddenPostProcess work with SearchBar module ?

leo_wang
Path Finder

As title.

I want to design a search page that showing the search results ( like flashtimeline ) and one or two statistics charts together for that search results, which need the HiddenPostProcess module after the SearchBar module to process the result data .

I have tried it, but It seems that HiddenPostProcess can't work with SearchBar module, or maybe I had done something wrong...... Any idea ?

Leo Wang

sideview
SplunkTrust
SplunkTrust

It can definitely be done. You just have to nest HiddenPostProcess within SearchBar and your ResultsTable within the HiddenPostProcess.

Here's a pretty simple example:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Simple Search Demo</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">All time</param>
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="label">Restart Search</param>
        <param name="allowSoftSubmit">True</param>

        <module name="HiddenPostProcess" layoutPanel="resultsAreaLeft>
          <param name="search">search user=* group=wheel</param>
          <module name="SimpleResultsTable">
          </module>

          </module>
        </module>
      </module>
    </module>
  </module>
</view>

what you will not be able to do (without writing some complex code in application.js), is have the Paginator work correctly with the postprocess-filtered data. And the counts in ResultsHeader and SimpleResultsHeader will also not account for the filtering.

But FlashChart, SingleValue, SimpleResultsTable, EventsViewer -- all the main rendering modules will work just fine.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Hi Splunkers, First off, thank you to everyone who participated in our very first From Data to Insight: The ...

Splunk Developers: Construct Your Future at the .conf26 Builder Bar

Calling all Splunk architects, platform admins, and app developers: the site is open, and the blueprints are ...

Quick connection discovery mode for forwarders

When a Splunk forwarder loses connectivity to its indexers, it does not always reconnect immediately. In many ...