Splunk Search

Why are real-time searches not working with my custom D3.js chart?

mr_brightside
Explorer

Hi,

I've created a custom dashboard with D3.js. Under "custom" I mean, that I've taken some chart, that is not present in Splunk by default, but could be added with d3.

Everything works good, but I have real-time searches not working.

The general description of how it works is:

I have a standard Splunk SearchManager that is added to my dashboard and it runs the search. On SearchManager.data() I run the parsing script and pass the resulting JSON to my custom d3 chart.

That works with any timerange except real-time searches.

Does anybody know what should be extended or what object should I customize to solve that problem?

Any advice would be greatly appreciated!

Many thanks in advance!

1 Solution

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

mr_brightside
Explorer

Thanks!

Using 'data("preview")' gave what i need, now everything works as desired

0 Karma
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...