All Apps and Add-ons

Splunk Web Framework: Get events from search in real time

user21041983
Explorer

Using Splunk Web framework, am evaluating D3 and vis.js charts w.r.t integration with Splunk events and able to generate the charts as well.

However, am only able to procure the events post the search is completed and then passing this to the charts. In the below snippet, renderChart is responsible to create the charts.

var datasource = mysearch.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

var onDataChanged = function(results) {
    if (!datasource.hasData()) {
        console.log("Data not found..");
        return;
    } else {
        console.log(results.collection().length + " Results found..");
    }
    var collection = results.collection().toJSON();
    renderChart(collection);
};

datasource.on('data', onDataChanged);
mysearch.startSearch();

I played around with the count parameter to check if that impacts how the results are handed over for further processing, without much success!

Can we get the Splunk events as and when the results are getting generated so that the graph looks more real time rather than rendering all at once?

0 Karma

arkadyz1
Builder

Found an answer here:

Replace 'results' with 'preview' in your var datasource=... statement!

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...