All Apps and Add-ons

Splunk Web Framework: Get events from search in real time

user21041983
Explorer

Using Splunk Web framework, am evaluating D3 and vis.js charts w.r.t integration with Splunk events and able to generate the charts as well.

However, am only able to procure the events post the search is completed and then passing this to the charts. In the below snippet, renderChart is responsible to create the charts.

var datasource = mysearch.data('results', {
    output_mode: 'json_rows',
    count: 0 // get all results
});

var onDataChanged = function(results) {
    if (!datasource.hasData()) {
        console.log("Data not found..");
        return;
    } else {
        console.log(results.collection().length + " Results found..");
    }
    var collection = results.collection().toJSON();
    renderChart(collection);
};

datasource.on('data', onDataChanged);
mysearch.startSearch();

I played around with the count parameter to check if that impacts how the results are handed over for further processing, without much success!

Can we get the Splunk events as and when the results are getting generated so that the graph looks more real time rather than rendering all at once?

0 Karma

arkadyz1
Builder

Found an answer here:

Replace 'results' with 'preview' in your var datasource=... statement!

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...