All Apps and Add-ons

Splunk Web Framework: Get events from search in real time


Using Splunk Web framework, am evaluating D3 and vis.js charts w.r.t integration with Splunk events and able to generate the charts as well.

However, am only able to procure the events post the search is completed and then passing this to the charts. In the below snippet, renderChart is responsible to create the charts.

var datasource ='results', {
    output_mode: 'json_rows',
    count: 0 // get all results

var onDataChanged = function(results) {
    if (!datasource.hasData()) {
        console.log("Data not found..");
    } else {
        console.log(results.collection().length + " Results found..");
    var collection = results.collection().toJSON();

datasource.on('data', onDataChanged);

I played around with the count parameter to check if that impacts how the results are handed over for further processing, without much success!

Can we get the Splunk events as and when the results are getting generated so that the graph looks more real time rather than rendering all at once?

0 Karma


Found an answer here:

Replace 'results' with 'preview' in your var datasource=... statement!

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.