Splunk Search

Is that possible to use HiddenPostProcess work with SearchBar module ?

leo_wang
Path Finder

As title.

I want to design a search page that showing the search results ( like flashtimeline ) and one or two statistics charts together for that search results, which need the HiddenPostProcess module after the SearchBar module to process the result data .

I have tried it, but It seems that HiddenPostProcess can't work with SearchBar module, or maybe I had done something wrong...... Any idea ?

Leo Wang

sideview
SplunkTrust
SplunkTrust

It can definitely be done. You just have to nest HiddenPostProcess within SearchBar and your ResultsTable within the HiddenPostProcess.

Here's a pretty simple example:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Simple Search Demo</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">All time</param>
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="label">Restart Search</param>
        <param name="allowSoftSubmit">True</param>

        <module name="HiddenPostProcess" layoutPanel="resultsAreaLeft>
          <param name="search">search user=* group=wheel</param>
          <module name="SimpleResultsTable">
          </module>

          </module>
        </module>
      </module>
    </module>
  </module>
</view>

what you will not be able to do (without writing some complex code in application.js), is have the Paginator work correctly with the postprocess-filtered data. And the counts in ResultsHeader and SimpleResultsHeader will also not account for the filtering.

But FlashChart, SingleValue, SimpleResultsTable, EventsViewer -- all the main rendering modules will work just fine.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...