Splunk Search

Dynamically update table based on number of splunk searches

sumangala
Path Finder

Hi Splunkers,

I need to update table element based on splunk search result. To achieve this I need to map with splunk search id search_id to manager id of the table to display search result into table. Splunk search changes every time, but same table needs to be updated with latest result. Problem here is I need to provide every time new id (currently search_id_table) to table element which generates new table instead of updating table. With same table id, it gives error Uncaught Error: Already have instance with id: in Splunk
Do u have any idea regarding this?

  search_query = new SearchManager({
         "id": search_id,
         "status_buckets": 0,
         "cancelOnUnload": true,
         "search": search_cmd,
         "latest_time": "$latest$",
         "earliest_time": "$earliest$",
         "app": utils.getCurrentApp(),
         "auto_cancel": 90,
         "preview": true,
         "runWhenTimeIsUndefined": false,
         "timeout": "10"
     }, {tokens: true});

     var element1 = new TableElement({
         "id": search_id_table,
         "drilldown": "row",
         "rowNumbers": "undefined",
         "wrap": "undefined",
         "managerid": search_id,
         "el": $('#element1')
     }, {tokens: true}).render();
0 Karma
1 Solution

sumangala
Path Finder

Hi All,

This issue of updating splunk table dynamically is resolved. Table will not be updated automatically by removing id. To update table contents on every time search is executed, we need to remove already existing table contents and add the contents.
Every time below search executes, its search id search_id should be linked to table element managerid like below code:

      search_query = new SearchManager({
            "id": search_id,
            "status_buckets": 0,
            "cancelOnUnload": true,
            "search": search_cmd,
            "latest_time": "$latest$",
            "earliest_time": "$earliest$",
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "preview": true,
            "runWhenTimeIsUndefined": false,
            "timeout": "10"
        }, {tokens: true});

       var element1 = new TableElement({
            "id": search_id_table,
            "drilldown": "row",
            "rowNumbers": "undefined",
            "wrap": "undefined",
            "managerid": search_id,
            "el": $('#element1')
        }, {tokens: true}).render();

       # This removes the Table contents. So we need to add table after its been removed.
       mvc.Components.getInstance(search_id_table).remove();

       # Adding splunk table element with innerHTML
       document.getElementById("row1").innerHTML+= '<div id="panel1" class="dashboard-cell" style="width: 100%;">  <div class="dashboard-panel clearfix"> <div class="panel-element-row"> <div id="element1" class="dashboard-element table" style="width: 100%">  <div class="panel-head"> <h3>Query Table</h3> </div> <div class="panel-body"></div> </div> </div> </div> </div>';

This code helps you to update Splunk table dymanically everytime u execute Splunk search with search result.

View solution in original post

0 Karma

sumangala
Path Finder

Hi All,

This issue of updating splunk table dynamically is resolved. Table will not be updated automatically by removing id. To update table contents on every time search is executed, we need to remove already existing table contents and add the contents.
Every time below search executes, its search id search_id should be linked to table element managerid like below code:

      search_query = new SearchManager({
            "id": search_id,
            "status_buckets": 0,
            "cancelOnUnload": true,
            "search": search_cmd,
            "latest_time": "$latest$",
            "earliest_time": "$earliest$",
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "preview": true,
            "runWhenTimeIsUndefined": false,
            "timeout": "10"
        }, {tokens: true});

       var element1 = new TableElement({
            "id": search_id_table,
            "drilldown": "row",
            "rowNumbers": "undefined",
            "wrap": "undefined",
            "managerid": search_id,
            "el": $('#element1')
        }, {tokens: true}).render();

       # This removes the Table contents. So we need to add table after its been removed.
       mvc.Components.getInstance(search_id_table).remove();

       # Adding splunk table element with innerHTML
       document.getElementById("row1").innerHTML+= '<div id="panel1" class="dashboard-cell" style="width: 100%;">  <div class="dashboard-panel clearfix"> <div class="panel-element-row"> <div id="element1" class="dashboard-element table" style="width: 100%">  <div class="panel-head"> <h3>Query Table</h3> </div> <div class="panel-body"></div> </div> </div> </div> </div>';

This code helps you to update Splunk table dymanically everytime u execute Splunk search with search result.

0 Karma

sumangala
Path Finder

Hi sbbadri,

I have tried this initially, after removing ID for TableElement splunk automatically assigns the new ID. But, this creates new instance of the table and new table will be generated instead of updating already existing of table contents(as per below image).
Is there any other way to update table contents?

alt text

0 Karma

niketn
Legend

@sumangala, If you want to change a setting for Table Element element1 , instead of creating the same element, you can access it via

var myTableElement= mvc.Components.get('element1');

Then, you can apply the changes or extension as per your need. Refer to several examples in Splunk 6.x Dashboard Examples app regarding the same like Table Row Highlighting.
You should also check out Splunk Web Framework details on Splunk Documentation (http://docs.splunk.com/Documentation/WebFramework) and Splunk Dev site (http://dev.splunk.com/view/SP-CAAAE49) to understand it better.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sumangala
Path Finder

@niketnilay:
Thank you for providing good documentation links.

0 Karma

sbbadri
Motivator

Hi Sumangala,

Don't use id on element1. splunk automatically assign id to table element.

  var element1 = new TableElement({      
      "drilldown": "row",
      "rowNumbers": "undefined",
      "wrap": "undefined",
      "managerid": search_id,
      "el": $('#element1')
  }, {tokens: true}).render();

i hope it helps

Regards,
Badri

0 Karma

sumangala
Path Finder

Hi badri,

After removing table id, splunk automatically assigns new id to the table. But, it used to create new instance everytime with new table as shown in above commented image.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...