KVStore on remote server

dokaas_2 — Wed, 30 Sep 2020 00:04:40 GMT

So this is bugging me. I've got the following script in an HTML form in Splunk:

//
// Get the collection of indexes
var myindexes = service.indexes();

        // Get an index to send events to
        myindexes.fetch(function(err, myindexes) {
          var myindex = myindexes.item("main");

          // Submit an event to the index
          myindex.submitEvent("Case Opened - lit", {
              sourcetype: "notes"
          }, function(err, result, myindex) {
            console.log("Submitted event: ", result);
          });
        });

Which works. But, if I add a line to use a variable instead of a literal string such as:

//
// Get the collection of indexes
var myindexes = service.indexes();
var event = "Date=" + form_Date + ", BacklogID=" + form_BacklogID + ", evtID=" + form_evtID + ", Comments=" + form_Comments + ", Author=" + form_Author;

        // Get an index to send events to
        myindexes.fetch(function(err, myindexes) {
          var myindex = myindexes.item("main");

          // Submit an event to the index
          myindex.submitEvent(event, {
              sourcetype: "siem:alarm:notes"
          }, function(err, result, myindex) {
            console.log("Submitted event: ", result);
          });
        });

it doesn't give an error, but it doesn't add the record either. I've debugged and stepped into the code and the var event does have data, but nothing gets pushed to the index.

What gives? Anybody have an idea?

topic KVStore on remote server in Dashboards & Visualizations

KVStore on remote server