Splunk Search

Set token in Javascript doesnt trigger update in Simple XML

rmearkle
Explorer

I am trying to update a table when an item in my javascript chart is clicked. Previously, this worked fine:
JavaScript:

function drilldown(appName){
                tokens.set("vsadid", appName);
                console.log(appName);               mvc.Components.getInstance("drilldownSearch").startSearch();            
            }

Splunk HTML:

<div id="drilldownSearch" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{    &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;|inputlookup combinedrisk.csv | search VSADID=$$vsadid$$ | table VSADID RiskScore FootPrintFactor RiskTag Tier5 Tier4&quot; }, &quot;cache&quot;: false,    &quot;preview&quot;: false    }">
        </div>

But my search string became so complex with single and double quotes and < and > that I wanted to switch to XML to use the CDATA tag. So now my code is:

JavaScript: Same
Splunk XML:

<panel depends="$vsadid$">
      <title>Data View</title>
      <table id="drilldownTable">
      <search id="drilldownSearch">
        <query><![CDATA[|search VSADID=$vsadid$]] truncated for clarity></query>
        </search>
      </table>
    </panel>

Except the problem is that this search does not start unless I change one of the other input drop-downs I have in the dashboard, which cause the searches to run on change. And when the token changes, the table won't change unless I do the same thing. Why is this?

0 Karma
1 Solution

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

View solution in original post

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

bmacias84
Champion

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down.

  // yourDropDown is the id of them drop down menu
  var tokens = mvc.Components.getInstance("default");
  var yourDropDown = mvc.Components.getInstance("yourDropDown")
  var drillDownSearch = mvc.Components.getInstance("drilldownSearch")

  // Using an event handler to listen for changes to the drop down.
  yourDropDown.on('change', function() {
    tokens.set("vsadid", appName);
    drillDownSearch.startSearch()
  })

take a peak at the following documentation.

WebFrame Work Reference
Tokens

rmearkle
Explorer

Unfortunately no, what I was trying to explain is that the token is set by an onClick event in javascript by a custom D3 chart, it just doesn't trigger the table to refresh. When I make a change to a dropdown on the page (not linked to that token) since it has the searchWhenChanged parameter linked, that other dropdown triggers the refresh.

0 Karma

svenwendler
Path Finder

I had the same issue - manually starting the search inside the event listener worked brilliantly for me.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas     Cisco Live 2026 is almost here, and this ...

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Hello Splunkers,   So you searched, “what is the name of the usb key inserted by bob smith?”  Not gonna lie… ...

Automating Threat Operations and Threat Hunting with Recorded Future

    Automating Threat Operations and Threat Hunting with Recorded Future June 29, 2026 | Register   Is your ...