Dashboards & Visualizations

Using JavaScript variables in SearchManager

fratamicod
Explorer

I am using SplunkJS to display an HTML page with JavaScript. I have tried everything to try and get the SearchManager query to use a JavaScript variable (ex. using splQuery, +splQuery+, etc.). If I enter the Splunk query in quotes instead of the variable, it does work.

 

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: splQuery
});

 

Labels (1)
0 Karma
1 Solution

fratamicod
Explorer

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: "| " + splQuery
});

View solution in original post

fratamicod
Explorer

I had to use a combination of plain text and a JavaScript variable for this to work.

var splQuery = "makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: "| " + splQuery
});

bowesmana
SplunkTrust
SplunkTrust

Take a look at this example, where it sets the search property outside the initial constructor

https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches/searchproperties

i.e.

        // Update the search query
        mysearch.settings.set("search", "index=_internal | head 2");
0 Karma

fratamicod
Explorer

I just tried, but unfortunately this is not working. I'm still running into the same issue where the search is not using the JavaScript variable. In the below code, I even tried "+splQuery+" but nothing.

 

var splQuery = "| makeresults";
var SearchManager = require("splunkjs/mvc/searchmanager");

var mysearch = new SearchManager({
  id: "mysearch",
  autostart: "false",
  search: ""
});

mysearch.settings.set("search", splQuery);​

 

 

0 Karma

bowesmana
SplunkTrust
SplunkTrust

This is an example from the Splunk dashboard examples app - (Custom Table Row Expansion) - which shows lazy search string evaluation.

https://splunkbase.splunk.com/app/1603 

requirejs([
    '../app/simple_xml_examples/libs/underscore-1.6.0-umd-min',
    'splunkjs/mvc/tableview',
    'splunkjs/mvc/chartview',
    'splunkjs/mvc/searchmanager',
    'splunkjs/mvc',
    'splunkjs/mvc/simplexml/ready!'
], function(_, TableView, ChartView, SearchManager, mvc) {
    var EventSearchBasedRowExpansionRenderer = TableView.BaseRowExpansionRenderer.extend({
        initialize: function() {
            // initialize will run once, so we will set up a search and a chart to be reused.
            this._searchManager = new SearchManager({
                id: 'details-search-manager',
                preview: false
            });
            this._chartView = new ChartView({
                'managerid': 'details-search-manager',
                'charting.legend.placement': 'none'
            });
        },

        canRender: function(rowData) {
            // Since more than one row expansion renderer can be registered we let each decide if they can handle that
            // data
            // Here we will always handle it.
            return true;
        },

        render: function($container, rowData) {
            // rowData contains information about the row that is expanded.  We can see the cells, fields, and values
            // We will find the sourcetype cell to use its value
            var sourcetypeCell = _(rowData.cells).find(function (cell) {
                return cell.field === 'sourcetype';
            });

            //update the search with the sourcetype that we are interested in
            this._searchManager.set({ search: 'index=_internal sourcetype=' + sourcetypeCell.value + ' | timechart count' });

            // $container is the jquery object where we can put out content.
            // In this case we will render our chart and add it to the $container
            $container.append(this._chartView.render().el);
        }
    });

    var tableElement = mvc.Components.getInstance('expand_with_events');
    tableElement.getVisualization(function(tableView) {
        // Add custom cell renderer, the table will re-render automatically.
        tableView.addRowExpansionRenderer(new EventSearchBasedRowExpansionRenderer());
    });
});

 

0 Karma

fratamicod
Explorer

Still not working for me, unfortunately.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...