Splunk Search

Set token in Javascript doesnt trigger update in Simple XML

rmearkle
Explorer

I am trying to update a table when an item in my javascript chart is clicked. Previously, this worked fine:
JavaScript:

function drilldown(appName){
                tokens.set("vsadid", appName);
                console.log(appName);               mvc.Components.getInstance("drilldownSearch").startSearch();            
            }

Splunk HTML:

<div id="drilldownSearch" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options="{    &quot;search&quot;: { &quot;type&quot;: &quot;token_safe&quot;, &quot;value&quot;: &quot;|inputlookup combinedrisk.csv | search VSADID=$$vsadid$$ | table VSADID RiskScore FootPrintFactor RiskTag Tier5 Tier4&quot; }, &quot;cache&quot;: false,    &quot;preview&quot;: false    }">
        </div>

But my search string became so complex with single and double quotes and < and > that I wanted to switch to XML to use the CDATA tag. So now my code is:

JavaScript: Same
Splunk XML:

<panel depends="$vsadid$">
      <title>Data View</title>
      <table id="drilldownTable">
      <search id="drilldownSearch">
        <query><![CDATA[|search VSADID=$vsadid$]] truncated for clarity></query>
        </search>
      </table>
    </panel>

Except the problem is that this search does not start unless I change one of the other input drop-downs I have in the dashboard, which cause the searches to run on change. And when the token changes, the table won't change unless I do the same thing. Why is this?

0 Karma
1 Solution

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

View solution in original post

rmearkle
Explorer

I solved this issue by switching to a base search for all the calculations of lookups and evals, and just used a simple postprocess search created in my javascript code.

var dataSearch = new PostProcessManager({
                    "id": "dataSearch",
                    "managerid": "baseCalcSearch",
                    "search": "|search VSADID=$vsadid$ |table \"VSADID\""
                }, {tokens: true});

I was using XML just because of my long search string in a CDATA tag, but keeping the base search in CDATA XML and using these PostProcessManagers worked for me.

bmacias84
Champion

Ok, I think I see what you want. You want to use on event handler and bind it to the id of your drop down.

  // yourDropDown is the id of them drop down menu
  var tokens = mvc.Components.getInstance("default");
  var yourDropDown = mvc.Components.getInstance("yourDropDown")
  var drillDownSearch = mvc.Components.getInstance("drilldownSearch")

  // Using an event handler to listen for changes to the drop down.
  yourDropDown.on('change', function() {
    tokens.set("vsadid", appName);
    drillDownSearch.startSearch()
  })

take a peak at the following documentation.

WebFrame Work Reference
Tokens

rmearkle
Explorer

Unfortunately no, what I was trying to explain is that the token is set by an onClick event in javascript by a custom D3 chart, it just doesn't trigger the table to refresh. When I make a change to a dropdown on the page (not linked to that token) since it has the searchWhenChanged parameter linked, that other dropdown triggers the refresh.

0 Karma

svenwendler
Path Finder

I had the same issue - manually starting the search inside the event listener worked brilliantly for me.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...