I have a dashboard, and its objects have been optimized to use fewer searches by using HiddenSearch
and HiddenPostProcess
. Great.
However, when I click "view results" under one of the Post-Processed objects, it shows me the HiddenSearch
table - NOT what actually created the object (HiddenSearch
+ HiddenPostProcess
). This is very confusing to the user, who expects to see the exact numbers behind their pie chart, or whatnot. How can I make this happen?
This technique might help you out:
<module name="SubmitButton">
<param name="label">See the metrics events in a timeline view</param>
<module name="HiddenSearch">
<param name="search">index=_internal source=*metrics.log</param>
<module name="ViewRedirector">
<param name="viewTarget">flashtimeline</param>
</module> <!--ViewRedirector -->
</module> <!-- HiddenSearch -->
</module> <!-- SubmitButton -->
Which essentially gives you a replaced search for your view redirector, if I've understood your requirement correctly.
(The above is from the Splunk Dashboard Examples app, specifically advanced_lister_redirects
)
As an aside, I believe this 'just works' with the SideView Utils Redirector and PostProcess modules.
Frustrating. Because it's there when you click the "view results" link, so it is available somehow. I just need that job loaded, then split by the postprocess - this should just work.
I don't think you can get the postprocessed job SID to drill down to
Thanks, I'll have to try this, but I was ideally looking to take the search artifact from the main search and have it narrowed by the postprocess, and shown to the user. (Rather than running the search again.. Perhaps I can use loadjob?)