All Apps and Add-ons

Splunk Web Framework: Get events from search in real time

user21041983
Explorer

Using Splunk Web framework, am evaluating D3 and vis.js charts w.r.t integration with Splunk events and able to generate the charts as well.

However, am only able to procure the events post the search is completed and then passing this to the charts. In the below snippet, renderChart is responsible to create the charts.

var datasource = mysearch.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

var onDataChanged = function(results) {
    if (!datasource.hasData()) {
        console.log("Data not found..");
        return;
    } else {
        console.log(results.collection().length + " Results found..");
    }
    var collection = results.collection().toJSON();
    renderChart(collection);
};

datasource.on('data', onDataChanged);
mysearch.startSearch();

I played around with the count parameter to check if that impacts how the results are handed over for further processing, without much success!

Can we get the Splunk events as and when the results are getting generated so that the graph looks more real time rather than rendering all at once?

0 Karma

arkadyz1
Builder

Found an answer here:

Replace 'results' with 'preview' in your var datasource=... statement!

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...