Splunk Search

Using D3 donut with real-time search

dimitryz
Path Finder

Hi all,
I'm tying to use D3 donut chart with splunk real-time search.
I've defined SearchManager this way :
var search1 = new SearchManager({
"id": "search1",
"cancelOnUnload": true,
"latest_time": "rt",
"earliest_time": "rt",
"status_buckets": 0,
"search": "index=_internal |stats count by sourcetype",
"app": utils.getCurrentApp(),
"auto_cancel": 90,
"search_mode": "realtime",
"preview": true,
"runWhenTimeIsUndefined": true
}, {tokens: true});

And chart configuration is :

var donut_chart = new D3ChartView({
"id": "donut",
"managerid": "search1",
"type": "pieChart",
"el": $('#hook1')
}).render();

donut_chart.settings.set("setup", function(chart){
chart.color(d3.scale.category10().range());

chart.donut(true);

});

The problem is that I can't make real-time data to be shown correctly .
Unchecking one of parameters of donut chart suppose to change the chart itselt.
It's happening only for few seconds and atter it the parameter beckame checked again.
In search is not real-time uncheckin/checking working ok.
How can I solve the problem ?
Thanks.

Tags (2)
0 Karma

rcorbisier_splu
Splunk Employee
Splunk Employee

If you haven’t seen it yet, you might want to check out the Splunk reference app (https://splunkbase.splunk.com/app/1934/) with associated developer guidance (http://dev.splunk.com/goto/devguide) that was built by a Splunk dev team.

The current version covers app development topics from getting your data into Splunk Enterprise to building custom reporting through testing and packaging your app. There’s code (https://github.com/splunk/splunk-ref-pas-test) and tests (https://github.com/splunk/splunk-ref-pas-test) you can use and the development process is fully documented.

This is an ongoing dev effort by the team so check back often to see what’s been added. Also, feel free to post requests for future improvements and even contribute by reporting bugs or submitting pull requests.

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...