topic Re: Using JavaScript variables in SearchManager in Dashboards & Visualizations

Using JavaScript variables in SearchManager

fratamicod — Sat, 18 Jan 2025 18:46:06 GMT

I am using SplunkJS to display an HTML page with JavaScript. I have tried everything to try and get the SearchManager query to use a JavaScript variable (ex. using splQuery, +splQuery+, etc.). If I enter the Splunk query in quotes instead of the variable, it does work.

var splQuery = "| makeresults"; var SearchManager = require("splunkjs/mvc/searchmanager"); var mysearch = new SearchManager({ id: "mysearch", autostart: "false", search: splQuery });

Re: Using JavaScript variables in SearchManager

bowesmana — Sun, 19 Jan 2025 02:06:59 GMT

Take a look at this example, where it sets the search property outside the initial constructor

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchproperties

i.e.

// Update the search query mysearch.settings.set("search", "index=_internal | head 2");

Re: Using JavaScript variables in SearchManager

fratamicod — Sun, 19 Jan 2025 14:59:06 GMT

I just tried, but unfortunately this is not working. I'm still running into the same issue where the search is not using the JavaScript variable. In the below code, I even tried "+splQuery+" but nothing.

var splQuery = "| makeresults"; var SearchManager = require("splunkjs/mvc/searchmanager"); var mysearch = new SearchManager({ id: "mysearch", autostart: "false", search: "" }); mysearch.settings.set("search", splQuery);

Re: Using JavaScript variables in SearchManager

bowesmana — Sun, 19 Jan 2025 21:10:23 GMT

This is an example from the Splunk dashboard examples app - (Custom Table Row Expansion) - which shows lazy search string evaluation.

https://splunkbase.splunk.com/app/1603

requirejs([ '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min', 'splunkjs/mvc/tableview', 'splunkjs/mvc/chartview', 'splunkjs/mvc/searchmanager', 'splunkjs/mvc', 'splunkjs/mvc/simplexml/ready!' ], function(_, TableView, ChartView, SearchManager, mvc) { var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({ initialize: function() { // initialize will run once, so we will set up a search and a chart to be reused. this._searchManager = new SearchManager({ id: 'details-search-manager', preview: false }); this._chartView = new ChartView({ 'managerid': 'details-search-manager', 'charting.legend.placement': 'none' }); }, canRender: function(rowData) { // Since more than one row expansion renderer can be registered we let each decide if they can handle that // data // Here we will always handle it. return true; }, render: function($container, rowData) { // rowData contains information about the row that is expanded. We can see the cells, fields, and values // We will find the sourcetype cell to use its value var sourcetypeCell = _(rowData.cells).find(function (cell) { return cell.field === 'sourcetype'; }); //update the search with the sourcetype that we are interested in this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count' }); // $container is the jquery object where we can put out content. // In this case we will render our chart and add it to the $container $container.append(this._chartView.render().el); } }); var tableElement = mvc.Components.getInstance('expand_with_events'); tableElement.getVisualization(function(tableView) { // Add custom cell renderer, the table will re-render automatically. tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer()); }); });

Re: Using JavaScript variables in SearchManager

fratamicod — Tue, 21 Jan 2025 14:30:06 GMT

Still not working for me, unfortunately.

Re: Using JavaScript variables in SearchManager

fratamicod — Wed, 22 Jan 2025 19:26:17 GMT

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults"; var SearchManager = require("splunkjs/mvc/searchmanager"); var mysearch = new SearchManager({ id: "mysearch", autostart: "false", search: "| " + splQuery });