Splunk Search

How to Read Query results in JAVA SCRIPT in my View

ma_anand1984
Contributor

I would like to read query results(from Search Module) in my javascript written in my View.

Note: I'm not using js SDK

1 Solution

sideview
SplunkTrust
SplunkTrust

1) Well, the best advice I can give is to use Sideview Utils.

You can take the easy way out with a configuration like this:

<module name="Search">
  <param name="search">searchterms | stats avg(foo) as foo last(bar) as bar max(baz) as baz</param>

  <module name="ResultsValueSetter">
    <param name="fields">foo bar baz</param>

    <module name="CustomBehavior">
      <param name="customBehavior">doSomethingWithResults</param>

    </module>
  </module>
</module>

the ResultsValueSetter module will go get the field value from the first row of search results.

Then the CustomBehavior you can define in application.js

Sideview.utils.declareCustomBehavior("doSomethingWithResults", function(customBehaviorModule) {
    customBehaviorModule.onContextChange = function() {
      var context = this.getContext();
      var foo = context.get("foo");
      var bar = context.get("bar");
      var baz = context.get("baz");
      alert("woohoo! " + foo + ", " + bar + ", " + baz);
  }
});

2) The longer more involved route involves using the JS objects from the Splunk UI directly.

ie if you do

var search = context.get("search");

the "search" key is always an instance of Splunk.Search. Once you have one of these, they have a getUrl method.

var url = search.getUrl("results");

and you get use your method of choice to hit that URL and parse the JSON it returns...

The trick of it is exactly when and where to call that code. The CustomBehavior and ResultsValueSetter and HTML modules and all these guys on the other hand make this stuff pretty easy.

3) And the third option is to go somewhere in the middle. Use the nice CustomBehavior module to make it easier to attach custom code, but instead of using ResultsValueSetter, write your customBehavior to do things onJobDone, onContextChange, onJobProgress, etc, and have it hit the URL's directly and parse JSON etc...

View solution in original post

sideview
SplunkTrust
SplunkTrust

1) Well, the best advice I can give is to use Sideview Utils.

You can take the easy way out with a configuration like this:

<module name="Search">
  <param name="search">searchterms | stats avg(foo) as foo last(bar) as bar max(baz) as baz</param>

  <module name="ResultsValueSetter">
    <param name="fields">foo bar baz</param>

    <module name="CustomBehavior">
      <param name="customBehavior">doSomethingWithResults</param>

    </module>
  </module>
</module>

the ResultsValueSetter module will go get the field value from the first row of search results.

Then the CustomBehavior you can define in application.js

Sideview.utils.declareCustomBehavior("doSomethingWithResults", function(customBehaviorModule) {
    customBehaviorModule.onContextChange = function() {
      var context = this.getContext();
      var foo = context.get("foo");
      var bar = context.get("bar");
      var baz = context.get("baz");
      alert("woohoo! " + foo + ", " + bar + ", " + baz);
  }
});

2) The longer more involved route involves using the JS objects from the Splunk UI directly.

ie if you do

var search = context.get("search");

the "search" key is always an instance of Splunk.Search. Once you have one of these, they have a getUrl method.

var url = search.getUrl("results");

and you get use your method of choice to hit that URL and parse the JSON it returns...

The trick of it is exactly when and where to call that code. The CustomBehavior and ResultsValueSetter and HTML modules and all these guys on the other hand make this stuff pretty easy.

3) And the third option is to go somewhere in the middle. Use the nice CustomBehavior module to make it easier to attach custom code, but instead of using ResultsValueSetter, write your customBehavior to do things onJobDone, onContextChange, onJobProgress, etc, and have it hit the URL's directly and parse JSON etc...

sideview
SplunkTrust
SplunkTrust

If you look inside Sideview Utils itself, look at the application.js file, and you'll see the declarations for a number of customBehaviors there. Search across all the xml files for the customBehavior names, and you'll find the testcase views and documentation views that use them. Beyond that there are custombehavior examples in other apps that use Sideview Utils - for instance SoS.

0 Karma

kasu_praveen
Communicator

I was looking for almost same kind of stuff. Thanks for posting.

Can you describe or provide some examples on above mentioned 3rd option

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...