|
Hi, I want to create a dashboard with 4 tables. I used a hidden search with 4 hiddenpostprocess(s). But all 4 tables can not display. When I change tables to charts, all work well. Any suggestions? The version is 4.1.2. Here's a simpler example pasted below - in this example i add two hiddenpostprocesses. One to generate a "single value" and one to generate a "result table". The "single value" was rendered well but the "results table" display nothing.
Thanks, Dianbo |
|
OK. There's a central issue around using PostProcess http://www.splunk.com/base/Documentation/4.1.2/Developer/PostProcess This is a confusing topic and although its written up in the docs, the explanation there could probably be improved. When splunkd kicks off the 'base search', meaning the 'eventtype=LOGIN_FAIL' search, it sees no reason to do any extra work, so it wont do various nontrivial things like field extractions and summaries etc. It will do exactly the amount of work required to fulfill that search, extracting any fields referred to by the eventtype for instance. However it will not do any more work than that. Now at a later point your postProcess comes in, and its referring to an extracted field called UserId. Well this field doesnt exist in these results. a quick solution is just to put a However I recommend checking out the example in the 'ui_examples' app that's called "Using postProcess with dashboards", and in particular reading what that view has to say and the warnings it has. Hi nick, thanks for your help. I overlooked ui_examples's change from 3.4 to 4.1. Now, all tables can display well but i come into another problem. I add a paginator module between HiddenPostProcess and SimpleResultsTable (I add this change to the code i posted in the next answer), but it can not work correctly. It displays more that 100 pages of HiddenSearch other that 2 pages of results after stats command. Is it a bug or I do something wrong? Please help. Thanks. Dianbo
(08 Jun '10, 11:27)
dianbo 1
Unfortunately the Paginator (and also the SimpleResultsHeader/ResultsHeader modules) still dont work with the Paginator. Admittedly this makes the tables rather limited but we should have some way forward for it in our next big release.
(08 Jun '10, 16:57)
nick ♦
|
