Using JavaScript variables in SearchManager

[fratamicod]

I am using SplunkJS to display an HTML page with JavaScript. I have tried everything to try and get the SearchManager query to use a JavaScript variable (ex. using splQuery, +splQuery+, etc.). If I enter the Splunk query in quotes instead of the variable, it does work.

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: splQuery
});

[fratamicod · Accepted solution]

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: "| " + splQuery
});

[bowesmana]

Take a look at this example, where it sets the search property outside the initial constructor

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchproperties

i.e.

        // Update the search query
        mysearch.settings.set("search", "index=_internal | head 2");

[fratamicod]

I just tried, but unfortunately this is not working. I'm still running into the same issue where the search is not using the JavaScript variable. In the below code, I even tried "+splQuery+" but nothing.

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: ""
});

mysearch.settings.set("search", splQuery);​

[bowesmana]

This is an example from the Splunk dashboard examples app - (Custom Table Row Expansion) - which shows lazy search string evaluation.

https://splunkbase.splunk.com/app/1603 

requirejs([
    '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/chartview',
    'splunkjs/mvc/searchmanager',
    'splunkjs/mvc',
    'splunkjs/mvc/simplexml/ready!'
], function(_, TableView, ChartView, SearchManager, mvc) {
    var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({
        initialize: function() {
            // initialize will run once, so we will set up a search and a chart to be reused.
            this._searchManager = new SearchManager({
                id: 'details-search-manager',
                preview: false
            });
            this._chartView = new ChartView({
                'managerid': 'details-search-manager',
                'charting.legend.placement': 'none'
            });
        },

        canRender: function(rowData) {
            // Since more than one row expansion renderer can be registered we let each decide if they can handle that
            // data
            // Here we will always handle it.
            return true;
        },

        render: function($container, rowData) {
            // rowData contains information about the row that is expanded.  We can see the cells, fields, and values
            // We will find the sourcetype cell to use its value
            var sourcetypeCell = _(rowData.cells).find(function (cell) {
                return cell.field === 'sourcetype';
            });

            //update the search with the sourcetype that we are interested in
            this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count' });

            // $container is the jquery object where we can put out content.
            // In this case we will render our chart and add it to the $container
            $container.append(this._chartView.render().el);
        }
    });

    var tableElement = mvc.Components.getInstance('expand_with_events');
    tableElement.getVisualization(function(tableView) {
        // Add custom cell renderer, the table will re-render automatically.
        tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer());
    });
});

[fratamicod]

Still not working for me, unfortunately.