Splunk Search

Errors everywhere / splunk.js SDK

gaRe
Explorer

Hello,

i am trying to start a search with the splunk-js-sdk and some own js-code. i've got several issues by programming this. i have no idea what's wrong and i have read every tutorial or documentation but it seems that nothing really match to my problems.

Dashboard-XML Code:

<.dashboard stylesheet="splunk-mva.css" script="splunk.js, splunk-mva.js, jquery-1.7.2.js".>

splunk-mva.js is my own libary for the searchcalls.

splunk-mva.js Code:

var http = new splunkjs.ProxyHttp(".."); <--- Param"/proxy" doenst work for me and why do i need http-instance? i am inside splunk.

var splunkService = new splunkjs.Service(http, {sessionKey: document.cookie}); <-- user:/password: doesn't work either

var queryString = "select * from bild b join shopposition s on b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='92956795'";

var searchParams = { output__mode: "JSON", exec___mode: "normal", id: "mvaJob" };

I tried two search-methods, both don't work for me:

first

splunkService.oneshotSearch(queryString, searchParams,  function(err, results) {code}

second

splunkService.search(queryString, searchParams, function(err, job) {code}

------------------------------------------------ HTTP-HEADERS-FROM REQUEST -----------------------------------------

Request URL:....../de-DE/app/services/search/jobs?output_mode=json

Request Method:POST

Status Code:200 OK

Request Headersview source

Accept:text/javascript, text/html, application/xml, text/xml, /

Accept-Encoding:gzip,deflate,sdch

Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4

Authorization:.......token.....

Connection:keep-alive

Content-Length:374

Content-Type:application/x-www-form-urlencoded

Cookie:..............session_id............. ; ......splunkweb_csrf_token.....

Host: ...........de

Origin:.................de

http:.................de

Referer:http:............../de-DE/app/analytics/test13

User-Agent:Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69

Safari/537.36

X-ProxyDestination:localhost:8089/services/search/jobs?output_mode=json

X-Requested-With:XMLHttpRequest

X-Splunk-Form-Key:6737785215983761462

Q*uery String Parametersview sourceview URL encoded*

output_mode:json

Form Dataview sourceview URL encoded

output_mode:JSON

exec_mode:normal

id:mvaJob

search:select * from bild b join shopposition s on b.bildnummer=s.bildnummer
join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer
join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer
where artnr.artikelnummer='92956795'

Response Headersview source

Connection:close

Content-Length:478

Content-Type:text/json;charset=utf-8

Date:Thu, 09 Jan 2014 15:02:49 GMT

Server:CherryPy/3.1.2

Set-Cookie:session_id..........................; expires=Fri, 10 Jan 2014 15:02:49 GMT; httponly; Path=/

Set-Cookie:splunkweb_csrf_token.................. ; expires=Tue, 08 Jan 2019 15:02:49 GMT; Path=/

RESPONSE

{"total": 0, "data": null, "count": 0,
"success": false, "offset": 0,
"messages": [{"message":
"Ung\u00fcltiger*(Invalid)*
Viewstate-Parametername: search;
Vorgang wird abgebrochen*(operation
is aborting)
*", "type": "ERROR",
"time": "2014-01-09T16:02:49"}]}

Any idea?

1 Solution

aelliott
Motivator

If you are inside splunk itself, you might as well use the SplunkJS instead of the SDK.
http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAESV

View solution in original post

0 Karma

gaRe
Explorer

It's 6.0.1

0 Karma

aelliott
Motivator

If you are inside splunk itself, you might as well use the SplunkJS instead of the SDK.
http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAESV

0 Karma

gaRe
Explorer

Thank you very much. You deserve a beer!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Firstly: What version Splunk?

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...