Hi,
I am trying to figure out a way where for a PostProcess search, ViewRedirectorLink popup displays exact search instead of base search in the new window. For e.g. take a look at below snippet:
Both the "View results" link open up with: "index=_internal source="*web_access.log" | stats count sum(bytes) as totalBytes by file, status"
If I'm undestanding the need, I think I had the same Problem, and I made the following :
(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search
<module name="HTML">
<param name="html"><![CDATA[
<a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
<a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
]]></param>
</module>
In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string
I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace
If I'm undestanding the need, I think I had the same Problem, and I made the following :
(I use Sideview-Utils)
I've made links in a HTML Module :
- one where the user see the results in a search window, without having to start the search again
- one where he can start and modify the search
<module name="HTML">
<param name="html"><![CDATA[
<a href="flashtimeline?q=| loadjob $results.sid$">view raw search results</a><br>
<a href="flashtimeline?q=$search$&earliest=$search.timeRange.earliest$&latest=$search.timeRange.latest$">run the search again in Splunk's default search page</a>
]]></param>
</module>
In this example I didn't took the postprocess, but it should be simple to add $prostprocess$ to $search$, having both in the url string
I had some troubles, so you can also see my related post :
http://answers.splunk.com/answers/99680/use-query-foo-in-html-module-error-with-whitespace
I have this same issue. Is there any way to get the full and final query, including post processing?
Can somebody answer if this is even possible in postprocess in Yes or NO?