Dashboards & Visualizations

Can I use free Splunk instance to run JavaScript code to extend simple XML or the meaning of this error message?

yshen
Path Finder

I'm using a free Splunk instance to develop dashboard mostly with simple XML before I deploy it to the production system. 

The trial license of the free Splunk instance has expired. I can still use it for the development. However,  when I tried to use JavaScript to extend a dashboard, I could not get the JavaScript working, in the sense that I don't see the print out statement executed as I could not see the print out on the web console. I only got the following error message:

 

"common.js:1063 GET http://l-yshen:8000/en-US/splunkd/__raw/servicesNS/admin/search/alerts/alert_actions?output_mode=json&search=(is_custom%3D1+OR+name%3D%22email%22+OR+name%3D%22script%22+OR+name%3D%22lookup%22)+AND+disabled!%3D1&count=1000&_=1602204254014 402 (Payment Required)".

 

I wonder the meaning of the error message? 

I guess that it might have something related to payment/license. The javascript file in question common.js is not of mine, probably from Splunk's own.

Any suggestion how I can get my javascript running, or how to investigate the root cause of its not running? I wish to learn how to find any response or clue of my mistakes.

Here is the script that I having difficulty with:

 

require([
'jquery',
'underscore',
'splunkjs/mvc',
'splunkjs/mvc/simplexml/ready!'
],
function($,_,mvc){
	var multi1 = mvc.Components.get("multi1")
	multi1.on("change",function(){
		current_val = multi1.val()
		console.log("Current Vals: " + current_val)
		var first_choice_value = multi1.options.choices[0].value;
		if (current_val.length > 1 && current_val.indexOf(first_choice_value) == 0) {
			multi1.val(_.without(current_val, first_choice_value));
		}
		if (current_val.length > 1 && current_val.indexOf(first_choice_value) > 0) {
			multi1.val([first_choice_value]);
		}
	})
}
)
©

 

It's copied from here:

https://www.youtube.com/watch?v=kQLV9AOL-FE&t=503s

Labels (3)
0 Karma

niketnilay
Legend

@yshen Simple XML JS extension should work as the issue you have listed is unrelated to dashboard. Have you added id="multi1" for the multi-select input you have created in the UI? If so please share Simple XML snippet for multi-select as well.

Also while debugging JS it is good practice to add console.log like console.log("Inside my multi-select JS script") as first executable JS line so that you can debug into issues through Browser console. In your example you are having console log inside multiselect change handler which may not execute if mulitselect with ID multi1 does not exists in SimpleXML. Also you may have to bump, refresh, restart Splunk, followed by internet Browser history cleanup depending on your Dev environment configuration for static files like JS, CSS, images to work.

Following is bare-minimal code which I tried and worked (shows output in Browser Inspector Console).

 

<form script="multiselect.js">
  <label>Multiselect through JS</label>
  <fieldset submitButton="false">
    <input id="multi1" type="multiselect" token="multi1" searchWhenChanged="true">
      <label>Multiselect 1</label>
      <choice value="a">Apple</choice>
      <choice value="b">Beta</choice>
      <choice value="c">Charlie</choice>
    </input>
  </fieldset>
</form>

Following is required JS but do not know its actual purpose and catch watch whole video tutorial to understand what is your use case. Just want to let you know that most Multi-Select output can be handled in Simple XML as well (following answer explains similar use case but with check-box instead of multi-select: https://community.splunk.com/t5/Dashboards-Visualizations/Can-I-hide-unhide-specific-text-boxes-usin...).

require([
    'jquery',
    'underscore',
    'splunkjs/mvc',
    'splunkjs/mvc/simplexml/ready!'
],
    function ($, _, mvc) {
        console.log("Inside Multiselect JS");
        var multi1 = mvc.Components.get("multi1")
        multi1.on("change", function () {
            current_val = multi1.val()
            console.log("Current Vals: " + current_val)
            var first_choice_value = multi1.options.choices[0].value;
            if (current_val.length > 1 && current_val.indexOf(first_choice_value) == 0) {
                multi1.val(_.without(current_val, first_choice_value));
            }
            if (current_val.length > 1 && current_val.indexOf(first_choice_value) > 0) {
                multi1.val([first_choice_value]);
            }
        });
    });

 

 

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

yshen
Path Finder

@niketnilay Thanks for detailed help, very informative!

Today, I checked again of my implementation. It's working now. Perhaps, I didn't restart enough, or not restarting at the right timing? (I did librarily start, as it's a development instance.). 

I can see the print out, even the logic works! But it seems somehow the response is a bit sluggish.

The logic that I want is to have "All" option automatically removed, when user select more specific option, and add "All" back, when user removes all other options.

(But the part of logics being working, I'm not sure which contributes its working, as I using two solutions. One is with JavaScript to handle the change, at the same time, I'm also using Simple XML in the change clause to update the options. I'll try to isolate which makes the logic working.)

I still have more questions:

for a production system, I cannot afford to restart Splunk, I was told in the video tutorial, that I could use the following url to reload the JavaScript's update:

http://l-yshen:8000/en-US/_bump()

but it didn't work for me yet. You mentioned some other options (bump, refresh, restart Splunk, followed by internet Browser history cleanup depending on your Dev environment configuration), I'd like to learn what's the proper way to experiment. I'm using Chrome browser.

For the sake of completeness, here is the corresponding Simple XML code for the multi-select panel:

<form script="multiselect_enhence.js" theme="dark">
  <label>Temperatures of UPS and External Sensor</label>
  <description>This dashboard provides panels to examine the temperatures </description>
  <fieldset submitButton="false" autoRun="true">
    <input id="multi1" token="Device_Type" searchWhenChanged="true" type="multiselect">
      <label>Types of Sensor</label>
      <choice value="*">All</choice>
      <fieldForLabel>Device_Type</fieldForLabel>
      <fieldForValue>Device_Type</fieldForValue>
      <search>
        <query>index="cse_scada"
| dedup Device_Type
| sort Device_Type</query>
      </search>
      <default>*</default>
      <initialValue>*</initialValue>
      <prefix>(</prefix>
      <suffix>)</suffix>
      <delimiter>, </delimiter>
         <change>
    <eval token="form.Device_Type">case(mvcount('form.Device_Type')=0,"All",mvcount('form.Device_Type')&gt;1 AND mvfind('form.Device_Type',"All")&gt;0,"All",mvcount('form.Device_Type')&gt;1 AND mvfind('form.Device_Type',"All")=0,mvfilter('form.Device_Type'!="All"),1==1,'form.Device_Type')</eval>
    <eval token="env">if(mvfind('form.Device_Type',"All")=0,"environment=*",$Device_Type$)</eval>
  </change>     
    </input>

Thanks greatly!

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi
When you have production license then you could get personal development license 50GB per day for 6 month. You could renew it after that. https://dev.splunk.com/enterprise/dev_license/
Personally I prefer that on dev environment instead of use trial or free.

If I recall right free version is not supporting alerts?
r. Ismo

yshen
Path Finder

@isoutamo Thanks for the license information!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!