Splunk Search

Set token in Javascript doesnt trigger update in Simple XML

rmearkle
Explorer

I am trying to update a table when an item in my javascript chart is clicked. Previously, this worked fine:
JavaScript:

function drilldown(appName){
                tokens.set("vsadid", appName);
                console.log(appName);               mvc.Components.getInstance("drilldownSearch").startSearch();            
            }

Splunk HTML:

<div id="drilldownSearch" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{    &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;|inputlookup combinedrisk.csv | search VSADID=$$vsadid$$ | table VSADID RiskScore FootPrintFactor RiskTag Tier5 Tier4&quot; }, &quot;cache&quot;: false,    &quot;preview&quot;: false    }">
        </div>

But my search string became so complex with single and double quotes and < and > that I wanted to switch to XML to use the CDATA tag. So now my code is:

JavaScript: Same
Splunk XML:

<panel depends="$vsadid$">
      <title>Data View</title>
      <table id="drilldownTable">
      <search id="drilldownSearch">
        <query><![CDATA[|search VSADID=$vsadid$]] truncated for clarity></query>
        </search>
      </table>
    </panel>

Except the problem is that this search does not start unless I change one of the other input drop-downs I have in the dashboard, which cause the searches to run on change. And when the token changes, the table won't change unless I do the same thing. Why is this?

0 Karma
1 Solution

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

View solution in original post

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

bmacias84
Champion

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down.

  // yourDropDown is the id of them drop down menu
  var tokens = mvc.Components.getInstance("default");
  var yourDropDown = mvc.Components.getInstance("yourDropDown")
  var drillDownSearch = mvc.Components.getInstance("drilldownSearch")

  // Using an event handler to listen for changes to the drop down.
  yourDropDown.on('change', function() {
    tokens.set("vsadid", appName);
    drillDownSearch.startSearch()
  })

take a peak at the following documentation.

WebFrame Work Reference
Tokens

rmearkle
Explorer

Unfortunately no, what I was trying to explain is that the token is set by an onClick event in javascript by a custom D3 chart, it just doesn't trigger the table to refresh. When I make a change to a dropdown on the page (not linked to that token) since it has the searchWhenChanged parameter linked, that other dropdown triggers the refresh.

0 Karma

svenwendler
Path Finder

I had the same issue - manually starting the search inside the event listener worked brilliantly for me.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...