Splunk Search

Splunk Web framework: 'searchmanager' received some positional argument(s) after some keyword argument(s)

arkadyz1
Builder

I'm getting the above error message ( 'searchmanager' received some positional argument(s) after some keyword argument(s)) with the JavaScript code containing this (I'm experimenting with real-time searches in Splunk Web now):

        var SearchManager = require("splunkjs/mvc/searchmanager");
        var mySearchManager = new SearchManager(
            id: "test-rt-search",
            search: "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
            preview: true,
            cache: false,
            "earliest_time": "rt-5m",
            "latest_time": "rt"
        );

I tried to shuffle the members to no avail. Is there any specification on which members should go first?

0 Karma
1 Solution

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

View solution in original post

0 Karma

arkadyz1
Builder

It's weird - I never managed to get JavaScript to work, even following the advice of @alacercogitatus and comparing my code with various examples (including those that worked for me in other templates in the same application!). So I switched to Django bindings like this:

{% block managers %}
    {% searchmanager id="test-rt-search"  
        search="index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len"
        earliest_time="rt-5m"
        latest_time="rt"
        preview=True
    %} 
{% endblock managers %}

and this (inside JavaScript):

var mySearchManager = mvc.Components.get("test-rt-search");

and it started working! I'm still not sure what I did wrong, though...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

There is no order, but don't mix quoted and non-quoted options. Also, Make sure you are sending over an object.
So your code should be this:

var mySearchManager = new SearchManager( {
         "id": "test-rt-search",
         "search" : "index=_internal sourcetype=splunkd | eval msg_len=if(isnull(message), 0, len(message)) | fields component,eventtype,host,msg_len",
         "preview": true,
         "cache": false,
         "earliest_time": "rt-5m",
         "latest_time": "rt"
     } );

The documentation for SearchManager can be found here: http://docs.splunk.com/DocumentationStatic/WebFramework/1.1/compref_searchmanager.html

arkadyz1
Builder

Thanks for the answer. I fixed the code the way you suggested (adding curly braces around the members and putting quotes around the names) - unfortunately, it still fails with the same error. Anything in django_error.log which could help me pinpoint the problem?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Wait - Are you using an HTML Dashboard, or the Django Web Framework?

0 Karma

arkadyz1
Builder

Django Web Framework.

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

If you are using Splunk 6, you should start converting your Django dashboards into HTML/Simple XML. Django will be deprecated in the near future, so better to start now.

This is relevant: http://dev.splunk.com/view/SP-CAAAENJ

This javascript will work in an HTML Dashboard.

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...