Splunk Search

Is that possible to use HiddenPostProcess work with SearchBar module ?

Path Finder

As title.

I want to design a search page that showing the search results ( like flashtimeline ) and one or two statistics charts together for that search results, which need the HiddenPostProcess module after the SearchBar module to process the result data .

I have tried it, but It seems that HiddenPostProcess can't work with SearchBar module, or maybe I had done something wrong...... Any idea ?

Leo Wang


It can definitely be done. You just have to nest HiddenPostProcess within SearchBar and your ResultsTable within the HiddenPostProcess.

Here's a pretty simple example:

<view onunloadCancelJobs="False" autoCancelInterval="100">
  <!--  autoCancelInterval is set here to 100  -->
  <label>Simple Search Demo</label>
  <module name="AccountBar" layoutPanel="appHeader"/>
  <module name="AppBar" layoutPanel="navigationHeader"/>
  <module name="Message" layoutPanel="messaging">
    <param name="filter">*</param>
    <param name="clearOnJobDispatch">False</param>
    <param name="maxSize">1</param>

  <module name="SearchBar" layoutPanel="splSearchControls-inline">
    <param name="useAssistant">true</param>
    <param name="useTypeahead">true</param>
    <param name="useOwnSubmitButton">False</param>
    <module name="TimeRangePicker">
      <param name="selected">All time</param>
      <param name="searchWhenChanged">True</param>
      <module name="SubmitButton">
        <param name="label">Restart Search</param>
        <param name="allowSoftSubmit">True</param>

        <module name="HiddenPostProcess" layoutPanel="resultsAreaLeft>
          <param name="search">search user=* group=wheel</param>
          <module name="SimpleResultsTable">


what you will not be able to do (without writing some complex code in application.js), is have the Paginator work correctly with the postprocess-filtered data. And the counts in ResultsHeader and SimpleResultsHeader will also not account for the filtering.

But FlashChart, SingleValue, SimpleResultsTable, EventsViewer -- all the main rendering modules will work just fine.