Splunk Search

Errors everywhere / splunk.js SDK

gaRe
Explorer

Hello,

i am trying to start a search with the splunk-js-sdk and some own js-code. i've got several issues by programming this. i have no idea what's wrong and i have read every tutorial or documentation but it seems that nothing really match to my problems.

Dashboard-XML Code:

<.dashboard stylesheet="splunk-mva.css" script="splunk.js, splunk-mva.js, jquery-1.7.2.js".>

splunk-mva.js is my own libary for the searchcalls.

splunk-mva.js Code:

var http = new splunkjs.ProxyHttp(".."); <--- Param"/proxy" doenst work for me and why do i need http-instance? i am inside splunk.

var splunkService = new splunkjs.Service(http, {sessionKey: document.cookie}); <-- user:/password: doesn't work either

var queryString = "select * from bild b join shopposition s on b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='92956795'";

var searchParams = { output__mode: "JSON", exec___mode: "normal", id: "mvaJob" };

I tried two search-methods, both don't work for me:

first

splunkService.oneshotSearch(queryString, searchParams,  function(err, results) {code}

second

splunkService.search(queryString, searchParams, function(err, job) {code}

------------------------------------------------ HTTP-HEADERS-FROM REQUEST -----------------------------------------

Request URL:....../de-DE/app/services/search/jobs?output_mode=json

Request Method:POST

Status Code:200 OK

Request Headersview source

Accept:text/javascript, text/html, application/xml, text/xml, /

Accept-Encoding:gzip,deflate,sdch

Accept-Language:de-DE,de;q=0.8,en-US;q=0.6,en;q=0.4

Authorization:.......token.....

Connection:keep-alive

Content-Length:374

Content-Type:application/x-www-form-urlencoded

Cookie:..............session_id............. ; ......splunkweb_csrf_token.....

Host: ...........de

Origin:.................de

http:.................de

Referer:http:............../de-DE/app/analytics/test13

User-Agent:Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69

Safari/537.36

X-ProxyDestination:localhost:8089/services/search/jobs?output_mode=json

X-Requested-With:XMLHttpRequest

X-Splunk-Form-Key:6737785215983761462

Q*uery String Parametersview sourceview URL encoded*

output_mode:json

Form Dataview sourceview URL encoded

output_mode:JSON

exec_mode:normal

id:mvaJob

search:select * from bild b join shopposition s on b.bildnummer=s.bildnummer
join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer
join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer
where artnr.artikelnummer='92956795'

Response Headersview source

Connection:close

Content-Length:478

Content-Type:text/json;charset=utf-8

Date:Thu, 09 Jan 2014 15:02:49 GMT

Server:CherryPy/3.1.2

Set-Cookie:session_id..........................; expires=Fri, 10 Jan 2014 15:02:49 GMT; httponly; Path=/

Set-Cookie:splunkweb_csrf_token.................. ; expires=Tue, 08 Jan 2019 15:02:49 GMT; Path=/

RESPONSE

{"total": 0, "data": null, "count": 0,
"success": false, "offset": 0,
"messages": [{"message":
"Ung\u00fcltiger*(Invalid)*
Viewstate-Parametername: search;
Vorgang wird abgebrochen*(operation
is aborting)
*", "type": "ERROR",
"time": "2014-01-09T16:02:49"}]}

Any idea?

1 Solution

aelliott
Motivator

If you are inside splunk itself, you might as well use the SplunkJS instead of the SDK.
http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAESV

View solution in original post

0 Karma

gaRe
Explorer

It's 6.0.1

0 Karma

aelliott
Motivator

If you are inside splunk itself, you might as well use the SplunkJS instead of the SDK.
http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAESV

0 Karma

gaRe
Explorer

Thank you very much. You deserve a beer!

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Firstly: What version Splunk?

Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...