Splunk Web framework: 'searchmanager' received some positional argument(s) after some keyword argument(s)

[arkadyz1]

I'm getting the above error message ( 'searchmanager' received some positional argument(s) after some keyword argument(s)) with the JavaScript code containing this (I'm experimenting with real-time searches in Splunk Web now):

        var SearchManager = require("splunkjs/mvc/searchmanager");
        var mySearchManager = new SearchManager(
            id: "test-rt-search",
            search: "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
            preview: true,
            cache: false,
            "earliest_time": "rt-5m",
            "latest_time": "rt"
        );

I tried to shuffle the members to no avail. Is there any specification on which members should go first?

[arkadyz1 · Accepted solution]

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

[alacercogitatus]

There is no order, but don't mix quoted and non-quoted options. Also, Make sure you are sending over an object.
So your code should be this:

var mySearchManager = new SearchManager( {
         "id": "test-rt-search",
         "search" : "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
         "preview": true,
         "cache": false,
         "earliest_time": "rt-5m",
         "latest_time": "rt"
     } );

The documentation for SearchManager can be found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_searchmanager.html

[arkadyz1]

Thanks for the answer. I fixed the code the way you suggested (adding curly braces around the members and putting quotes around the names) - unfortunately, it still fails with the same error. Anything in django_error.log which could help me pinpoint the problem?

[alacercogitatus]

Wait - Are you using an HTML Dashboard, or the Django Web Framework?

[arkadyz1]

Django Web Framework.

[alacercogitatus]

If you are using Splunk 6, you should start converting your Django dashboards into HTML/Simple XML. Django will be deprecated in the near future, so better to start now.

This is relevant: http://dev.splunk.com/view/SP-CAAAENJ

This javascript will work in an HTML Dashboard.