Splunk Search

Set token in Javascript doesnt trigger update in Simple XML

rmearkle
Explorer

I am trying to update a table when an item in my javascript chart is clicked. Previously, this worked fine:
JavaScript:

function drilldown(appName){
                tokens.set("vsadid", appName);
                console.log(appName);               mvc.Components.getInstance("drilldownSearch").startSearch();            
            }

Splunk HTML:

<div id="drilldownSearch" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{    &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;|inputlookup combinedrisk.csv | search VSADID=$$vsadid$$ | table VSADID RiskScore FootPrintFactor RiskTag Tier5 Tier4&quot; }, &quot;cache&quot;: false,    &quot;preview&quot;: false    }">
        </div>

But my search string became so complex with single and double quotes and < and > that I wanted to switch to XML to use the CDATA tag. So now my code is:

JavaScript: Same
Splunk XML:

<panel depends="$vsadid$">
      <title>Data View</title>
      <table id="drilldownTable">
      <search id="drilldownSearch">
        <query><![CDATA[|search VSADID=$vsadid$]] truncated for clarity></query>
        </search>
      </table>
    </panel>

Except the problem is that this search does not start unless I change one of the other input drop-downs I have in the dashboard, which cause the searches to run on change. And when the token changes, the table won't change unless I do the same thing. Why is this?

0 Karma
1 Solution

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

View solution in original post

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

bmacias84
Champion

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down.

  // yourDropDown is the id of them drop down menu
  var tokens = mvc.Components.getInstance("default");
  var yourDropDown = mvc.Components.getInstance("yourDropDown")
  var drillDownSearch = mvc.Components.getInstance("drilldownSearch")

  // Using an event handler to listen for changes to the drop down.
  yourDropDown.on('change', function() {
    tokens.set("vsadid", appName);
    drillDownSearch.startSearch()
  })

take a peak at the following documentation.

WebFrame Work Reference
Tokens

rmearkle
Explorer

Unfortunately no, what I was trying to explain is that the token is set by an onClick event in javascript by a custom D3 chart, it just doesn't trigger the table to refresh. When I make a change to a dropdown on the page (not linked to that token) since it has the searchWhenChanged parameter linked, that other dropdown triggers the refresh.

0 Karma

svenwendler
Path Finder

I had the same issue - manually starting the search inside the event listener worked brilliantly for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...