Splunk Dev

How to dynamically change a web framework visualization's binding to a search manager?

rtev
Path Finder

After following along with a published example I'm trying to perform something like this...

var search1 = new SearchManager({ ... });
var search2 = new SearchManager({ ... });
var tableView = new TableView({ ... "managerid": "search1" }).render();

// change search manager binding for tableView from search1 to search2.
tableView.setManagerId(search2); // ????

The source code for many of the visualizations is located in SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/splunkjs/mvc and, at least some of them, inherit functionality from the BaseVisualizationView class (visualizationview.js). That class contains a private method that gives the impression that visualizations react to connection manager changes.

363         _onManagerChange: function(managers) {
364             // clean up listeners
365             if (this.managers) {
366                 _.each(this.managers, function(manager) {
367                     this.stopListening(manager);
368                 }, this);
369                 this.managers = null;
370             }

371             if (managers == null || managers.length === 0) {
372                 this.message('no-search');
373                 return;
374             }
375             if (managers) {
376                 this.managers = managers;
377                 this._bindDataSources();
378                 _.each(this.managers, function(manager) {
379                     // only for primary manager
380                     if (manager.getType() === 'primary') {
381                         this.primaryManager = manager;
382                         this._clearPrimaryResults();
383                         this.message('empty');
384                         // listeners for all managers
385                         this.listenTo(manager, 'search:fail', this._onPrimarySearchFail);
386                         this.listenTo(manager, 'search:error', this._onPrimarySearchError);
387                         this.listenTo(manager, 'search:start', this._onPrimarySearchStart);
388                         this.listenTo(manager, 'search:progress search:done', this._onPrimarySearchProgress);
389                         this.listenTo(manager, 'search:done', this._onPrimarySearchDone);
390                         this.listenTo(manager, 'search:cancelled', this._onPrimarySearchCancelled);
391                         this.listenTo(manager, 'search:refresh', this._onPrimarySearchRefresh);
392                         manager.replayLastSearchEvent(this);
393                     }
394                 }, this);
395             }
396         },

It may be that the files Datasource.es and SearchManagerConnection.es located in SPLUNK_HOME/share/splunk/search_mrsparkle/exposed/js/helpers/search play some role in orchestrating connections between Visualizations and SearchManagers.

Currently it seems that if this is a feature of the Web Framework public API it's not documented. I'm making this post in the hope that someone can give me a quick answer rather than continuing to comb through the source code. Thank you!

Tags (1)
0 Karma
1 Solution

rtev
Path Finder

It looks like Web Framework components have a method:

settings.set( property, value )
described as:

Sets the value of property to the
specified value for the current
component.
which means the answer may be:

var search1 = new SearchManager({ id="search1" ... });
var search2 = new SearchManager({ id="search2" ... });
var tableView = new TableView({ "managerid": "search1" ... });
tableView.settings.set("managerid", "search2");

View solution in original post

0 Karma

niketn
Legend

@rtev it would be easier for the community members to assist you if you provide more details on what is your use case? What are the two searches you are trying to run? Also under what condition do you want to change the searches for the table?

On a different note, any reason why you are not doing this directly in Simple XML and trying to use Splunk Web Framework instead?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rtev
Path Finder

Business People want a dashboard that iterates running a search over and over, adjusting part of the search, until certain conditions are met. Don't actually need this functionality now, but figured I'd answer the question after I found what looked like the answer. Splunk documentation is somewhat fractured in different locations, but it's definitely improving steadily.

0 Karma

niketn
Legend

@rtev, if you have found your answer, kindly post the details and accept your own answer to mark this question as answered and help others facing similar issues in future.

I do feel there is a simpler approach to this kind of use case. However, as I would need more specifics of the requirements, we can ignore for the time being 😉

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

rtev
Path Finder

I posted the - possible - answer. When/If I have time to verify it works I'll accept it. Thanks for your comments.

0 Karma

rtev
Path Finder

It looks like Web Framework components have a method:

settings.set( property, value )
described as:

Sets the value of property to the
specified value for the current
component.
which means the answer may be:

var search1 = new SearchManager({ id="search1" ... });
var search2 = new SearchManager({ id="search2" ... });
var tableView = new TableView({ "managerid": "search1" ... });
tableView.settings.set("managerid", "search2");
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...