Splunk Search

Is that possible to use HiddenPostProcess work with SearchBar module ?

leo_wang
Path Finder

As title.

I want to design a search page that showing the search results ( like flashtimeline ) and one or two statistics charts together for that search results, which need the HiddenPostProcess module after the SearchBar module to process the result data .

I have tried it, but It seems that HiddenPostProcess can't work with SearchBar module, or maybe I had done something wrong...... Any idea ?

Leo Wang

sideview
SplunkTrust
SplunkTrust

It can definitely be done. You just have to nest HiddenPostProcess within SearchBar and your ResultsTable within the HiddenPostProcess.

Here's a pretty simple example:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Simple Search Demo</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>
  </module>

  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">All time</param>
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="label">Restart Search</param>
        <param name="allowSoftSubmit">True</param>

        <module name="HiddenPostProcess" layoutPanel="resultsAreaLeft>
          <param name="search">search user=* group=wheel</param>
          <module name="SimpleResultsTable">
          </module>

          </module>
        </module>
      </module>
    </module>
  </module>
</view>

what you will not be able to do (without writing some complex code in application.js), is have the Paginator work correctly with the postprocess-filtered data. And the counts in ResultsHeader and SimpleResultsHeader will also not account for the filtering.

But FlashChart, SingleValue, SimpleResultsTable, EventsViewer -- all the main rendering modules will work just fine.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...