Dashboards & Visualizations

How do I make the "view results" link properly show the data from my PostProcess?

Jason
Motivator

I have a dashboard, and its objects have been optimized to use fewer searches by using HiddenSearch and HiddenPostProcess. Great.

However, when I click "view results" under one of the Post-Processed objects, it shows me the HiddenSearch table - NOT what actually created the object (HiddenSearch + HiddenPostProcess). This is very confusing to the user, who expects to see the exact numbers behind their pie chart, or whatnot. How can I make this happen?

dart
Splunk Employee
Splunk Employee

This technique might help you out:

<module name="SubmitButton">
<param name="label">See the metrics events in a timeline view</param>
          <module name="HiddenSearch">
            <param name="search">index=_internal source=*metrics.log</param>
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module> <!--ViewRedirector -->
          </module> <!-- HiddenSearch -->
        </module> <!-- SubmitButton -->

Which essentially gives you a replaced search for your view redirector, if I've understood your requirement correctly.
(The above is from the Splunk Dashboard Examples app, specifically advanced_lister_redirects)

As an aside, I believe this 'just works' with the SideView Utils Redirector and PostProcess modules.

Jason
Motivator

Frustrating. Because it's there when you click the "view results" link, so it is available somehow. I just need that job loaded, then split by the postprocess - this should just work.

0 Karma

dart
Splunk Employee
Splunk Employee

I don't think you can get the postprocessed job SID to drill down to

0 Karma

Jason
Motivator

Thanks, I'll have to try this, but I was ideally looking to take the search artifact from the main search and have it narrowed by the postprocess, and shown to the user. (Rather than running the search again.. Perhaps I can use loadjob?)

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...