Dashboards & Visualizations

Can I cache searches in Simple XML using the method available in an HTML/JavaScript dashboard?

kierencrossland
Path Finder

I have a dashboard that I have created using simple XML, there are several graphs that have search in like this:

<search>
  <query>search ...</query>
  <earliest>-15m</earliest>
  <latest>now</latest>
</search>

I would like to be able to cache these searches in the same way that I can if I convert the simple XML dashboard to HTML/JavaScript by setting the cache option (see '"cache": 900' in the example below). Does anyone know if this is possible without having to convert to HTML?

        var search1 = new SearchManager({
            "id": "search1",
            "latest_time": "now",
            "earliest_time": "-15m",
            "search": "search...",
            "status_buckets": 0,
            "cancelOnUnload": true,
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "preview": true,
            "runWhenTimeIsUndefined": false,
            "cache": 900
        }, {tokens: true, tokenNamespace: "submitted"});
1 Solution

piUek
Path Finder

You can change the cache parameter of the search from the simplexml.
To do this attach the js to your root dashboard / form element in the simplexml file:

<dashboard script="test.js">

Also add the id to Your search:

<search id="mysearch">

Then create the script file named test.js in your appdirectory/appserver/static/test.js

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc, ignore) {
    // grab the mysearch handler:
    var mysearch = mvc.Components.getInstance('mysearch')

    // set cache to 900
    mysearch.set('cache', 900);

    // print cache value to console
    console.log(mysearch.get('cache'));
});

This works for splunk 6.3 - with the added scrpit id attribute. Without this You'd have to get search id (maybe with method mvc.Components.getInstanceNames().

More reliable would be building your dashboard using JavaScript. There is a guide for doing this: http://dev.splunk.com/view/SP-CAAAE4A, examples page: http://dev.splunk.com/view/SP-CAAAEU7#xmlextensions and basic example for starters: http://dev.splunk.com/view/SP-CAAAE4M.

Using JavaScript extensions You'll get full control of the page.

View solution in original post

piUek
Path Finder

You can change the cache parameter of the search from the simplexml.
To do this attach the js to your root dashboard / form element in the simplexml file:

<dashboard script="test.js">

Also add the id to Your search:

<search id="mysearch">

Then create the script file named test.js in your appdirectory/appserver/static/test.js

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc, ignore) {
    // grab the mysearch handler:
    var mysearch = mvc.Components.getInstance('mysearch')

    // set cache to 900
    mysearch.set('cache', 900);

    // print cache value to console
    console.log(mysearch.get('cache'));
});

This works for splunk 6.3 - with the added scrpit id attribute. Without this You'd have to get search id (maybe with method mvc.Components.getInstanceNames().

More reliable would be building your dashboard using JavaScript. There is a guide for doing this: http://dev.splunk.com/view/SP-CAAAE4A, examples page: http://dev.splunk.com/view/SP-CAAAEU7#xmlextensions and basic example for starters: http://dev.splunk.com/view/SP-CAAAE4M.

Using JavaScript extensions You'll get full control of the page.

kierencrossland
Path Finder

Thanks piUek, I didnt realise I could extend simple xml like that.

Usually in this situation I would convert the dashboard to html/js, or use web frameworrk, but in doing this you lose some simplicity in maintaining the dashboard. I like the idea of keeping the dashboard in simple xml where possible, so using a javascript extension seems like the perfect solution.

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...