Developing for Splunk Enterprise
Highlighted

Splunk Django WebFramework : Cascading Form & Search

Super Champion

I was trying to build a django based web front-end using the examples shown in "Splunk Web Framework Toolkit". The example shown for cascaded form is "technically" NOT a cascading search, but rather searches the "whole" data every single time.
Original Example.

    {% block managers %}
    {% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
    {% searchmanager id="sourcetypesearch" search="| metadata index=$index$ OR index=_$index$ type=sourcetypes"|token_safe
    cache=True preview=True autostart=False %}
    {% endblock managers %}

What it means is: The search is run everytime with value from previous selection. So its not actually cascading the search, but rather redoing the entire search !!.
Is there a way we can "cascade" the search too as we do in advanced XML (or sideviewutils) ?

I'm looking for something like..

{% block managers %}
{% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
{% searchmanager id="sourcetypesearch" search=$indexsearch$|token_safe
cache=True preview=True autostart=False %}
{% endblock managers %}

whereby the whole of "indexsearch" is passed as a token to the next search , rather than searching the whole once again?

0 Karma
Highlighted

Re: Splunk Django WebFramework : Cascading Form & Search

SplunkTrust
SplunkTrust

Why not a Post Process manager?

{% postprocessmanager
    id="sourcetypesearch"
    managerid="indexsearch"
    search="search <your_next_search>" %}

View solution in original post

Highlighted

Re: Splunk Django WebFramework : Cascading Form & Search

Super Champion

Perfect thanks. Didn't know we could use all functionalities in django.
Thanks mate

0 Karma