Dashboards & Visualizations

Stats Not Passing All Fields to Underscore Data Template in Web Framework

chrisdopuch
Path Finder

Hello,

What I am trying to do is create a customized HTML dashboard that renders a box with some statistics in it for each result returned from a search. I am using the Data Template as documented here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.0/compref_data.html (it is better documented in the web framework app, but I don't know where to find an online version of that to link https://apps.splunk.com/app/1613/).

So far it works decently well, I can get the template to print out the categoryID and count, but the other fields generated by stats (like avg(price)) are not being passed. I am working with the demo data that the Splunk tutorials give you. Whenever I do a JSON.stringify on the line var, it only has the fields categoryId and count.

UPDATE: I have tried a few more stats functions like distinct_count and also a rangemap. It passes the rangemap value perfectly as line.range, and it also passes a line.distinct_count(price) but it is always a zero, even though the actual search has actual results. Something very strange is going on here.

Here is my code:

tag openings removed to make them display properly
...

{% block content %}
script type="text/x-underscore-tmpl" id="top-artist-search-template" style="display:none">
div id="box-wrapper">
<% for(var i=0, l=results.length; i < l; i++) { var line=results[i];%>
div class="box" >
h2 class="profile" > <%= line.categoryId %>
div><%= line.count %>
div><%= line.avg_price %>
div><%= line.perc95_price %>
/div>
<% } %>
/div>
/script>

{% dataview 
    id="table-top-artist-searches"
    managerid="search-top-artist-searches"
    templateName="top-artist-search-template"
%}

{% endblock content %}

{% block managers %}

{% searchmanager id="search-top-artist-searches"
search='sourcetype=access_* status=200 action=purchase | stats count, avg(price) as avg_price, perc95(price) AS perc95_price by categoryId | sort avg(time) desc'
cache=True
%}

{% endblock managers %}

0 Karma
1 Solution

chrisdopuch
Path Finder

Ok, I figured out what was going wrong. I migrated this code from the server side (Django) over to the client side (just JS) and examined the GET and POST messages. Something was going wrong with either the transmission of the search, or the transmission of the search results. Instead I used a saved search (instead of one embedded in the page's source) and then it worked!

View solution in original post

0 Karma

chrisdopuch
Path Finder

Ok, I figured out what was going wrong. I migrated this code from the server side (Django) over to the client side (just JS) and examined the GET and POST messages. Something was going wrong with either the transmission of the search, or the transmission of the search results. Instead I used a saved search (instead of one embedded in the page's source) and then it worked!

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...