topic Re: Dynamically update table based on number of splunk searches in Splunk Search

Dynamically update table based on number of splunk searches

sumangala — Thu, 20 Jul 2017 12:53:41 GMT

Hi Splunkers,

I need to update table element based on splunk search result. To achieve this I need to map with splunk search id search_id to manager id of the table to display search result into table. Splunk search changes every time, but same table needs to be updated with latest result. Problem here is I need to provide every time new id (currently search_id_table) to table element which generates new table instead of updating table. With same table id, it gives error Uncaught Error: Already have instance with id: in Splunk
Do u have any idea regarding this?

  search_query = new SearchManager({
         "id": search_id,
         "status_buckets": 0,
         "cancelOnUnload": true,
         "search": search_cmd,
         "latest_time": "$latest$",
         "earliest_time": "$earliest$",
         "app": utils.getCurrentApp(),
         "auto_cancel": 90,
         "preview": true,
         "runWhenTimeIsUndefined": false,
         "timeout": "10"
     }, {tokens: true});

     var element1 = new TableElement({
         "id": search_id_table,
         "drilldown": "row",
         "rowNumbers": "undefined",
         "wrap": "undefined",
         "managerid": search_id,
         "el": $('#element1')
     }, {tokens: true}).render();

Re: Dynamically update table based on number of splunk searches

sbbadri — Thu, 20 Jul 2017 14:05:50 GMT

Hi Sumangala,

Don't use id on element1. splunk automatically assign id to table element.

  var element1 = new TableElement({      
      "drilldown": "row",
      "rowNumbers": "undefined",
      "wrap": "undefined",
      "managerid": search_id,
      "el": $('#element1')
  }, {tokens: true}).render();

i hope it helps

Regards,
Badri

Re: Dynamically update table based on number of splunk searches

sumangala — Fri, 21 Jul 2017 05:34:24 GMT

Hi sbbadri,

I have tried this initially, after removing ID for TableElement splunk automatically assigns the new ID. But, this creates new instance of the table and new table will be generated instead of updating already existing of table contents(as per below image).
Is there any other way to update table contents?

Re: Dynamically update table based on number of splunk searches

niketn — Fri, 21 Jul 2017 06:20:30 GMT

@sumangala, If you want to change a setting for Table Element element1 , instead of creating the same element, you can access it via

var myTableElement= mvc.Components.get('element1');

Then, you can apply the changes or extension as per your need. Refer to several examples in Splunk 6.x Dashboard Examples app regarding the same like Table Row Highlighting.
You should also check out Splunk Web Framework details on Splunk Documentation (http://docs.splunk.com/Documentation/WebFramework) and Splunk Dev site (http://dev.splunk.com/view/SP-CAAAE49) to understand it better.

Re: Dynamically update table based on number of splunk searches

sumangala — Mon, 24 Jul 2017 11:34:15 GMT

Hi All,

This issue of updating splunk table dynamically is resolved. Table will not be updated automatically by removing id. To update table contents on every time search is executed, we need to remove already existing table contents and add the contents.
Every time below search executes, its search id search_id should be linked to table element managerid like below code:

      search_query = new SearchManager({
            "id": search_id,
            "status_buckets": 0,
            "cancelOnUnload": true,
            "search": search_cmd,
            "latest_time": "$latest$",
            "earliest_time": "$earliest$",
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "preview": true,
            "runWhenTimeIsUndefined": false,
            "timeout": "10"
        }, {tokens: true});

       var element1 = new TableElement({
            "id": search_id_table,
            "drilldown": "row",
            "rowNumbers": "undefined",
            "wrap": "undefined",
            "managerid": search_id,
            "el": $('#element1')
        }, {tokens: true}).render();

       # This removes the Table contents. So we need to add table after its been removed.
       mvc.Components.getInstance(search_id_table).remove();

       # Adding splunk table element with innerHTML
       document.getElementById("row1").innerHTML+= '<div id="panel1" class="dashboard-cell" style="width: 100%;">  <div class="dashboard-panel clearfix"> <div class="panel-element-row"> <div id="element1" class="dashboard-element table" style="width: 100%">  <div class="panel-head"> <h3>Query Table</h3> </div> <div class="panel-body"></div> </div> </div> </div> </div>';

This code helps you to update Splunk table dymanically everytime u execute Splunk search with search result.

Re: Dynamically update table based on number of splunk searches

sumangala — Mon, 24 Jul 2017 11:36:12 GMT

@niketnilay:
Thank you for providing good documentation links.

Re: Dynamically update table based on number of splunk searches

sumangala — Mon, 24 Jul 2017 11:38:45 GMT

Hi badri,

After removing table id, splunk automatically assigns new id to the table. But, it used to create new instance everytime with new table as shown in above commented image.