Splunk Search

Splunk Web framework: 'searchmanager' received some positional argument(s) after some keyword argument(s)

arkadyz1
Builder

I'm getting the above error message ( 'searchmanager' received some positional argument(s) after some keyword argument(s)) with the JavaScript code containing this (I'm experimenting with real-time searches in Splunk Web now):

        var SearchManager = require("splunkjs/mvc/searchmanager");
        var mySearchManager = new SearchManager(
            id: "test-rt-search",
            search: "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
            preview: true,
            cache: false,
            "earliest_time": "rt-5m",
            "latest_time": "rt"
        );

I tried to shuffle the members to no avail. Is there any specification on which members should go first?

0 Karma
1 Solution

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

View solution in original post

0 Karma

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

There is no order, but don't mix quoted and non-quoted options. Also, Make sure you are sending over an object.
So your code should be this:

var mySearchManager = new SearchManager( {
         "id": "test-rt-search",
         "search" : "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
         "preview": true,
         "cache": false,
         "earliest_time": "rt-5m",
         "latest_time": "rt"
     } );

The documentation for SearchManager can be found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_searchmanager.html

arkadyz1
Builder

Thanks for the answer. I fixed the code the way you suggested (adding curly braces around the members and putting quotes around the names) - unfortunately, it still fails with the same error. Anything in django_error.log which could help me pinpoint the problem?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Wait - Are you using an HTML Dashboard, or the Django Web Framework?

0 Karma

arkadyz1
Builder

Django Web Framework.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you are using Splunk 6, you should start converting your Django dashboards into HTML/Simple XML. Django will be deprecated in the near future, so better to start now.

This is relevant: http://dev.splunk.com/view/SP-CAAAENJ

This javascript will work in an HTML Dashboard.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...