Splunk Dev

Splunk Django WebFramework : Cascading Form & Search

koshyk
Super Champion

I was trying to build a django based web front-end using the examples shown in "Splunk Web Framework Toolkit". The example shown for cascaded form is "technically" NOT a cascading search, but rather searches the "whole" data every single time.
Original Example.

    {% block managers %}
    {% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
    {% searchmanager id="sourcetypesearch" search="| metadata index=$index$ OR index=_$index$ type=sourcetypes"|token_safe
    cache=True preview=True autostart=False %}
    {% endblock managers %}

What it means is: The search is run everytime with value from previous selection. So its not actually cascading the search, but rather redoing the entire search !!.
Is there a way we can "cascade" the search too as we do in advanced XML (or sideviewutils) ?

I'm looking for something like..

{% block managers %}
{% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
{% searchmanager id="sourcetypesearch" search=$indexsearch$|token_safe
cache=True preview=True autostart=False %}
{% endblock managers %}

whereby the whole of "indexsearch" is passed as a token to the next search , rather than searching the whole once again?

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Why not a Post Process manager?

{% postprocessmanager
    id="sourcetypesearch"
    managerid="indexsearch"
    search="search <your_next_search>" %}

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Why not a Post Process manager?

{% postprocessmanager
    id="sourcetypesearch"
    managerid="indexsearch"
    search="search <your_next_search>" %}

koshyk
Super Champion

Perfect thanks. Didn't know we could use all functionalities in django.
Thanks mate

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...