Why are real-time searches not working with my custom D3.js chart?

[mr_brightside]

Hi,

I've created a custom dashboard with D3.js. Under "custom" I mean, that I've taken some chart, that is not present in Splunk by default, but could be added with d3.

Everything works good, but I have real-time searches not working.

The general description of how it works is:

I have a standard Splunk SearchManager that is added to my dashboard and it runs the search. On SearchManager.data() I run the parsing script and pass the resulting JSON to my custom d3 chart.

That works with any timerange except real-time searches.

Does anybody know what should be extended or what object should I customize to solve that problem?

Any advice would be greatly appreciated!

Many thanks in advance!

[jeffland · Accepted solution]

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

[mr_brightside]

Thanks!

Using 'data("preview")' gave what i need, now everything works as desired