Dashboards & Visualizations

Using JavaScript variables in SearchManager

fratamicod
Explorer

I am using SplunkJS to display an HTML page with JavaScript. I have tried everything to try and get the SearchManager query to use a JavaScript variable (ex. using splQuery, +splQuery+, etc.). If I enter the Splunk query in quotes instead of the variable, it does work.

 

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: splQuery
});

 

Labels (1)
0 Karma
1 Solution

fratamicod
Explorer

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: "| " + splQuery
});

View solution in original post

fratamicod
Explorer

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: "| " + splQuery
});

bowesmana
SplunkTrust
SplunkTrust

Take a look at this example, where it sets the search property outside the initial constructor

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchproperties

i.e.

        // Update the search query
        mysearch.settings.set("search", "index=_internal | head 2");
0 Karma

fratamicod
Explorer

I just tried, but unfortunately this is not working. I'm still running into the same issue where the search is not using the JavaScript variable. In the below code, I even tried "+splQuery+" but nothing.

 

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: ""
});

mysearch.settings.set("search", splQuery);

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

This is an example from the Splunk dashboard examples app - (Custom Table Row Expansion) - which shows lazy search string evaluation.

https://splunkbase.splunk.com/app/1603 

requirejs([
    '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/chartview',
    'splunkjs/mvc/searchmanager',
    'splunkjs/mvc',
    'splunkjs/mvc/simplexml/ready!'
], function(_, TableView, ChartView, SearchManager, mvc) {
    var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({
        initialize: function() {
            // initialize will run once, so we will set up a search and a chart to be reused.
            this._searchManager = new SearchManager({
                id: 'details-search-manager',
                preview: false
            });
            this._chartView = new ChartView({
                'managerid': 'details-search-manager',
                'charting.legend.placement': 'none'
            });
        },

        canRender: function(rowData) {
            // Since more than one row expansion renderer can be registered we let each decide if they can handle that
            // data
            // Here we will always handle it.
            return true;
        },

        render: function($container, rowData) {
            // rowData contains information about the row that is expanded.  We can see the cells, fields, and values
            // We will find the sourcetype cell to use its value
            var sourcetypeCell = _(rowData.cells).find(function (cell) {
                return cell.field === 'sourcetype';
            });

            //update the search with the sourcetype that we are interested in
            this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count' });

            // $container is the jquery object where we can put out content.
            // In this case we will render our chart and add it to the $container
            $container.append(this._chartView.render().el);
        }
    });

    var tableElement = mvc.Components.getInstance('expand_with_events');
    tableElement.getVisualization(function(tableView) {
        // Add custom cell renderer, the table will re-render automatically.
        tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer());
    });
});

 

0 Karma

fratamicod
Explorer

Still not working for me, unfortunately.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...