Hello
I am trying to use postprocessing and having issues with it. Can anyone please help me out in understanding where am I going wrong here.
<?xml version='1.0' encoding='utf-8'?>
Regards
theou
You cant use values generated from selectors / intentions in post process.
Its a limitation, and the bane of my life.
sideview utils works around this - its a cool app.
Yep. Sideview Utils fills a lot of gaps like this. In this particular case it has PostProcess module to replace HiddenPostProcess. Not only can you do $foo$ substitution into PostProcess searches, but you don't have to think about intentions at all ever again -- the substitution is right from the raw tokens into the $foo$. No intention middleman. Also the Pulldown and TextField modules are much easier to use than the core equivalents. remember to get the latest version (2.2.2) from the Sideview site. The version on Splunkbase is actually quite old.