Splunk Search

Set token in Javascript doesnt trigger update in Simple XML

rmearkle
Explorer

I am trying to update a table when an item in my javascript chart is clicked. Previously, this worked fine:
JavaScript:

function drilldown(appName){
                tokens.set("vsadid", appName);
                console.log(appName);               mvc.Components.getInstance("drilldownSearch").startSearch();            
            }

Splunk HTML:

<div id="drilldownSearch" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{    &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;|inputlookup combinedrisk.csv | search VSADID=$$vsadid$$ | table VSADID RiskScore FootPrintFactor RiskTag Tier5 Tier4&quot; }, &quot;cache&quot;: false,    &quot;preview&quot;: false    }">
        </div>

But my search string became so complex with single and double quotes and < and > that I wanted to switch to XML to use the CDATA tag. So now my code is:

JavaScript: Same
Splunk XML:

<panel depends="$vsadid$">
      <title>Data View</title>
      <table id="drilldownTable">
      <search id="drilldownSearch">
        <query><![CDATA[|search VSADID=$vsadid$]] truncated for clarity></query>
        </search>
      </table>
    </panel>

Except the problem is that this search does not start unless I change one of the other input drop-downs I have in the dashboard, which cause the searches to run on change. And when the token changes, the table won't change unless I do the same thing. Why is this?

0 Karma
1 Solution

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

View solution in original post

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

bmacias84
Champion

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down.

  // yourDropDown is the id of them drop down menu
  var tokens = mvc.Components.getInstance("default");
  var yourDropDown = mvc.Components.getInstance("yourDropDown")
  var drillDownSearch = mvc.Components.getInstance("drilldownSearch")

  // Using an event handler to listen for changes to the drop down.
  yourDropDown.on('change', function() {
    tokens.set("vsadid", appName);
    drillDownSearch.startSearch()
  })

take a peak at the following documentation.

WebFrame Work Reference
Tokens

rmearkle
Explorer

Unfortunately no, what I was trying to explain is that the token is set by an onClick event in javascript by a custom D3 chart, it just doesn't trigger the table to refresh. When I make a change to a dropdown on the page (not linked to that token) since it has the searchWhenChanged parameter linked, that other dropdown triggers the refresh.

0 Karma

svenwendler
Path Finder

I had the same issue - manually starting the search inside the event listener worked brilliantly for me.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...