Dashboards & Visualizations

How do I make the "view results" link properly show the data from my PostProcess?

Jason
Motivator

I have a dashboard, and its objects have been optimized to use fewer searches by using HiddenSearch and HiddenPostProcess. Great.

However, when I click "view results" under one of the Post-Processed objects, it shows me the HiddenSearch table - NOT what actually created the object (HiddenSearch + HiddenPostProcess). This is very confusing to the user, who expects to see the exact numbers behind their pie chart, or whatnot. How can I make this happen?

dart
Splunk Employee
Splunk Employee

This technique might help you out:

<module name="SubmitButton">
<param name="label">See the metrics events in a timeline view</param>
          <module name="HiddenSearch">
            <param name="search">index=_internal source=*metrics.log</param>
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module> <!--ViewRedirector -->
          </module> <!-- HiddenSearch -->
        </module> <!-- SubmitButton -->

Which essentially gives you a replaced search for your view redirector, if I've understood your requirement correctly.
(The above is from the Splunk Dashboard Examples app, specifically advanced_lister_redirects)

As an aside, I believe this 'just works' with the SideView Utils Redirector and PostProcess modules.

Jason
Motivator

Frustrating. Because it's there when you click the "view results" link, so it is available somehow. I just need that job loaded, then split by the postprocess - this should just work.

0 Karma

dart
Splunk Employee
Splunk Employee

I don't think you can get the postprocessed job SID to drill down to

0 Karma

Jason
Motivator

Thanks, I'll have to try this, but I was ideally looking to take the search artifact from the main search and have it narrowed by the postprocess, and shown to the user. (Rather than running the search again.. Perhaps I can use loadjob?)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...