@kamlesh_vaghela
Its a simple JS, that make a search, convert the Transaction Results to JSON-Objects and simply print them as HTML-table.
I used a sample JS-View that i customized a bit.
Script thats directly referred in the Dashboard:
require([
"/static/app/fishingbot/tableview.js",
"splunkjs/mvc/searchmanager",
"splunkjs/mvc/simplexml/ready!"
], function(DemoView, SearchManager) {
// Create a custom view
var customView = new DemoView({
id: "mycustomview",
managerid: "mysearch",
el: $("#mycustomview")
}).render();
var mysearch = new SearchManager({
id: "mysearch",
preview: true,
cache: true,
search: "index=fishingbot | fields * | transaction maxspan=0s maxpause=0s | search message=\"*->*\" | where eventcount > 1 | table message",
earliest_time:"0",
latest_time:"now"
});
});
The second Script, that uses the Result, converts to JSON and prints as table:
/* demoview.js */
class EnchantedItem {
constructor(name, enchantments) {
this.name = name;
this.enchantments = enchantments;
}
};
class Enchantment {
constructor(name, level) {
this.name = name;
this.level = level;
}
};
define(function(require, exports, module){
// Base class for custom views
var SimpleSplunkView = require('splunkjs/mvc/simplesplunkview');
// Require Underscore.js to work with a list of search results
var _ = require("underscore");
// Define the custom view class
var DemoView = SimpleSplunkView.extend({
className: "demoview",
// Change the value of the "data" property
options: {
data: "results"
},
// Override this method to format your data in a specific way
// Our view expects HTML, so reformat the results array accordingly
formatData: function(data) {
// Display the data object to the console
console.log("The data object: ", data);
// Format each row of results as an HTML list
var items = [];
_.each(data, function(row, index){
let itemName = row[0][0].split(" ");
itemName = itemName[0].replace(/"/g, "");
itemName = itemName.replace(/_/g, " ");
let enchants = [];
row[0].shift();
row[0].forEach(function(val) {
var enchInfo = val.split(" ");
let enchant = new Enchantment(enchInfo[1].replace(/_/g, " "),enchInfo[2]);
enchants.push(enchant);
});
let enchItem = new EnchantedItem(itemName, enchants);
items.push(enchItem);
});
var mydatastring = "";
items.sort(dynamicSort("name"));
items.forEach(function(item) {
mydatastring = mydatastring + "<tr><td>" + item.name + "</td><td>";
item.enchantments.forEach(function(enchant) {
mydatastring = mydatastring + enchant.name + " " + enchant.level + "</br>";
})
mydatastring = mydatastring + "</td></tr>";
});
mydatastring = "<table class=\"table table-hover\"><thead><tr><td>Item</td><td>Enchantment<td></tr></thead><tbody>" + mydatastring + "</tbody></table>";
return mydatastring;
},
// Override this method to configure your view
createView: function() {
return this;
},
// Override this method to put the Splunk data into the view
updateView: function(viz, data) {
// Display the reformatted data object to the console
console.log("HTML-formatted data: ", data);
this.$el.html(data);
}
});
return DemoView;
});
