All Apps and Add-ons

Sideview: Table as EventsViewer Filter

snoobzilla
Builder

I am trying to do something that seems like it should be fairly simple, but I am stuck.

In a nutshell, I am using a table. When I select a row I want the corresponding event only to display in EventsViewer.

I have a search that returns events. When I put an EventsViewer directly below the table all of the events in the table display.

It seems like I should be able to do something like put a postprocess below the table with search...

FIELD=$row.fields.FIELD$

Where FIELD is distinct value for row. However, when I do this I get no results. What am I missing? I have tried all sorts of permutations of post processing.

Sideview Utils 3.2.6 do I need to upgrade?

1 Solution

snoobzilla
Builder

Ok, problem was post process search.... needed to be "search FIELD=$row.fields.FIELD$" not just "FIELD=$row.fields.FIELD$". Clearly I hadn't been using post process searches much.

View solution in original post

snoobzilla
Builder

Ok, problem was post process search.... needed to be "search FIELD=$row.fields.FIELD$" not just "FIELD=$row.fields.FIELD$". Clearly I hadn't been using post process searches much.

sideview
SplunkTrust
SplunkTrust

No no. hehe. the search-time extraction is fine. You just have to think a little differently about the base search. No matter what the base search is, you can construct it a little differently and you'll be fine. The docs page will explain all this. "Key Techniques - Using PostProcess - Introduction"

0 Karma

snoobzilla
Builder

Thanks Nick.

Sorry I missed that, will review and see if I can eliminate search time extractions.

0 Karma

sideview
SplunkTrust
SplunkTrust

Have you reviewed the pitfalls detailed in the PostProcess intro page in the Sideview docs? That's always my first stop when postprocess is involved. ie if the field isn't explicitly named in the base search and it's a search-time field extraction, you wont be able to filter on it in postprocess searches.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...