All Apps and Add-ons

Export different fields from what is shown in the Table module

cmak
Contributor

I show a Table module, and allow users to export the search contents in 1 search.
For example, my search includes

table field1, fields2, fields3, fields4

I want my table to show only field 1 and fields 2.
I want the exported data to show only field 3 and field4.

I can get the table to do what I want (hide field 3 and 4) by simply using the hiddenFields param.

<param name="hiddenFields">field3 field4</param>

However, I was wondering if I could limit the fields for export

1 Solution

sideview
SplunkTrust
SplunkTrust

Well the normal reaction here might be to try using postProcess, possibly wrapping the SearchControls module in a PostProcess module. However while the Sideview SearchControls module implements an export button, it's really just a thin wrapper around Splunk's Export functionality, and unfortunately in the end the exported results are totally unaffected by any postProcess search.

I'll add this to my list of improvements to explore. It would certainly nice to have export still use a given set of search results, but transform it at the last second while it's on its way out.

So to sum up, I think the only way is to submit a whole second search in parallel with the one you're displaying, use the same $foo$ tokens in both, but have the second search hooked up with the SearchControls module, and the first one hooked up to the Table.

View solution in original post

sideview
SplunkTrust
SplunkTrust

Well the normal reaction here might be to try using postProcess, possibly wrapping the SearchControls module in a PostProcess module. However while the Sideview SearchControls module implements an export button, it's really just a thin wrapper around Splunk's Export functionality, and unfortunately in the end the exported results are totally unaffected by any postProcess search.

I'll add this to my list of improvements to explore. It would certainly nice to have export still use a given set of search results, but transform it at the last second while it's on its way out.

So to sum up, I think the only way is to submit a whole second search in parallel with the one you're displaying, use the same $foo$ tokens in both, but have the second search hooked up with the SearchControls module, and the first one hooked up to the Table.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...