Developing for Splunk Enterprise

Rendering results as simple text in Splunk 6 Web Framework

Communicator

Good day everyone,

I am currently developing an app that displays a network diagram that consist of images. These images vary from the status of the element that will be pulled from Splunk. I am currently using Splunk 6 Web Framework. I was wondering what "Splunk View"/Wrapper should I use to render results as simple text and place them to a variable so I can pull them.

This is what I am doing. I have a search that pulls the status of a network element, let say if the value of the element ranges from 0-70 this will output an eval field called icon with the image filename on it (ex. server-icon-good.png), 71-90 is warning and 91-100 is alert (server-icon-warning.png and server-icon-alert.png). Now in my html code I will put an <img src="/dj/static/sampleapp/images/-- results of my search --"> so that it will render the image depending on its current range.

I found in the documentation using a DataTemplate view this seems achievable. Splunk 6 Web Framework.

I did some test and I have manage to render the images. In my search the eval value of the field icon would be the whole image path (ex. my search | eval icon="<img src='/dj/static/sampleapp/images/server-good.png'>" etc.), this is my temporary solution.

I was using sideview and rendering results are easier by using $results.[0].value$ and like commands. So I was wondering if this is also possible in Splunk 6 Web Framework other than the method I was using.

It would be a great help for me as a developer who started using the new Web Framework.

Thank you so much,

Communicator

I will take a look on that app. Thanks for the answers. I am not that familiar with javascript so I'll try to work on that also.

0 Karma

Splunk Employee
Splunk Employee

@crt86: did you get what you need from the below tutorials? You can also look at the Web Framework Toolkit for samples of custom views.

0 Karma

Communicator

Im not exactly shure, what you wanna do ...

But if you want to have a custom view where you can do things with the results by your own - I'll give you some ideas and code here:

  • have a look at : Create a custom Splunk view to create a custom view using Django & JS
  • Codesample for accessing results:

        updateView: function(viz, data) {
    
        console.log("The data object: ", data);
        var myResults = data[0];
        console.log(myResults);
    
    }
    

You can access the results (array) with data[0], data1, ..., data[0][0], data0, ..., data[1][0], ...

accourding the array : data [recordindex][fieldindex]

hope that helps,

Robert

0 Karma

Communicator

up for this question.

0 Karma

Communicator

up for this question. for today hope this won't report as spam thanks

0 Karma

Communicator

up for this question.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!