Splunk Search

Splunk Web framework: 'searchmanager' received some positional argument(s) after some keyword argument(s)

arkadyz1
Builder

I'm getting the above error message ( 'searchmanager' received some positional argument(s) after some keyword argument(s)) with the JavaScript code containing this (I'm experimenting with real-time searches in Splunk Web now):

        var SearchManager = require("splunkjs/mvc/searchmanager");
        var mySearchManager = new SearchManager(
            id: "test-rt-search",
            search: "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
            preview: true,
            cache: false,
            "earliest_time": "rt-5m",
            "latest_time": "rt"
        );

I tried to shuffle the members to no avail. Is there any specification on which members should go first?

0 Karma
1 Solution

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

View solution in original post

0 Karma

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

There is no order, but don't mix quoted and non-quoted options. Also, Make sure you are sending over an object.
So your code should be this:

var mySearchManager = new SearchManager( {
         "id": "test-rt-search",
         "search" : "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
         "preview": true,
         "cache": false,
         "earliest_time": "rt-5m",
         "latest_time": "rt"
     } );

The documentation for SearchManager can be found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_searchmanager.html

arkadyz1
Builder

Thanks for the answer. I fixed the code the way you suggested (adding curly braces around the members and putting quotes around the names) - unfortunately, it still fails with the same error. Anything in django_error.log which could help me pinpoint the problem?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Wait - Are you using an HTML Dashboard, or the Django Web Framework?

0 Karma

arkadyz1
Builder

Django Web Framework.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you are using Splunk 6, you should start converting your Django dashboards into HTML/Simple XML. Django will be deprecated in the near future, so better to start now.

This is relevant: http://dev.splunk.com/view/SP-CAAAENJ

This javascript will work in an HTML Dashboard.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...