Splunk Search

Splunk Web framework: 'searchmanager' received some positional argument(s) after some keyword argument(s)

arkadyz1
Builder

I'm getting the above error message ( 'searchmanager' received some positional argument(s) after some keyword argument(s)) with the JavaScript code containing this (I'm experimenting with real-time searches in Splunk Web now):

        var SearchManager = require("splunkjs/mvc/searchmanager");
        var mySearchManager = new SearchManager(
            id: "test-rt-search",
            search: "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
            preview: true,
            cache: false,
            "earliest_time": "rt-5m",
            "latest_time": "rt"
        );

I tried to shuffle the members to no avail. Is there any specification on which members should go first?

0 Karma
1 Solution

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

View solution in original post

0 Karma

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

There is no order, but don't mix quoted and non-quoted options. Also, Make sure you are sending over an object.
So your code should be this:

var mySearchManager = new SearchManager( {
         "id": "test-rt-search",
         "search" : "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
         "preview": true,
         "cache": false,
         "earliest_time": "rt-5m",
         "latest_time": "rt"
     } );

The documentation for SearchManager can be found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_searchmanager.html

arkadyz1
Builder

Thanks for the answer. I fixed the code the way you suggested (adding curly braces around the members and putting quotes around the names) - unfortunately, it still fails with the same error. Anything in django_error.log which could help me pinpoint the problem?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Wait - Are you using an HTML Dashboard, or the Django Web Framework?

0 Karma

arkadyz1
Builder

Django Web Framework.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you are using Splunk 6, you should start converting your Django dashboards into HTML/Simple XML. Django will be deprecated in the near future, so better to start now.

This is relevant: http://dev.splunk.com/view/SP-CAAAENJ

This javascript will work in an HTML Dashboard.

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...