Splunk Search

Get data from table from javascript

Explorer

Hello!
I had a simple XML app in SPLUNK.
I need to get all data from rendered table ( or before rendering ), like raw data, of rows, or something else.
And if data rows or columns more then, for example, 100, don't render this table.
How can i do it from my Javascript?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.

The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.

PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.

<form>
  <label>Hide Table if more than 100 results</label>
  <fieldset submitButton="false">
    <input type="text" token="tokNumberOfRows" searchWhenChanged="true">
      <label>Number of rows to be returned (for testing)</label>
      <default>100</default>
      <prefix>| head </prefix>
    </input>
  </fieldset>
  <row>
    <panel depends="$showTable$">
      <title>Table to be displayed only if less than 100 rows</title>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$job.resultCount$<101">
              <set token="showTable">true</set>
            </condition>
            <condition>
              <unset token="showTable"></unset>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <html rejects="$showTable$">
        <div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

SplunkTrust
SplunkTrust

@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.

The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.

PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.

<form>
  <label>Hide Table if more than 100 results</label>
  <fieldset submitButton="false">
    <input type="text" token="tokNumberOfRows" searchWhenChanged="true">
      <label>Number of rows to be returned (for testing)</label>
      <default>100</default>
      <prefix>| head </prefix>
    </input>
  </fieldset>
  <row>
    <panel depends="$showTable$">
      <title>Table to be displayed only if less than 100 rows</title>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$job.resultCount$<101">
              <set token="showTable">true</set>
            </condition>
            <condition>
              <unset token="showTable"></unset>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <html rejects="$showTable$">
        <div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Explorer

It very good option! THX for answer!
But anyway, how can I handle this by JavaScript?

0 Karma

SplunkTrust
SplunkTrust

@creemer, yes it is possible. Just convert the dashboard to HTML Dashboard and it will generate corresponding JavaScript using Splunk Web Framework. You can take out the JavaScript code you need from there. Please let me know if you need any help with JavaScript piece.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma