Dashboards & Visualizations

How do I make the "view results" link properly show the data from my PostProcess?

Jason
Motivator

I have a dashboard, and its objects have been optimized to use fewer searches by using HiddenSearch and HiddenPostProcess. Great.

However, when I click "view results" under one of the Post-Processed objects, it shows me the HiddenSearch table - NOT what actually created the object (HiddenSearch + HiddenPostProcess). This is very confusing to the user, who expects to see the exact numbers behind their pie chart, or whatnot. How can I make this happen?

dart
Splunk Employee
Splunk Employee

This technique might help you out:

<module name="SubmitButton">
<param name="label">See the metrics events in a timeline view</param>
          <module name="HiddenSearch">
            <param name="search">index=_internal source=*metrics.log</param>
            <module name="ViewRedirector">
              <param name="viewTarget">flashtimeline</param>
            </module> <!--ViewRedirector -->
          </module> <!-- HiddenSearch -->
        </module> <!-- SubmitButton -->

Which essentially gives you a replaced search for your view redirector, if I've understood your requirement correctly.
(The above is from the Splunk Dashboard Examples app, specifically advanced_lister_redirects)

As an aside, I believe this 'just works' with the SideView Utils Redirector and PostProcess modules.

Jason
Motivator

Frustrating. Because it's there when you click the "view results" link, so it is available somehow. I just need that job loaded, then split by the postprocess - this should just work.

0 Karma

dart
Splunk Employee
Splunk Employee

I don't think you can get the postprocessed job SID to drill down to

0 Karma

Jason
Motivator

Thanks, I'll have to try this, but I was ideally looking to take the search artifact from the main search and have it narrowed by the postprocess, and shown to the user. (Rather than running the search again.. Perhaps I can use loadjob?)

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...