Splunk Search

Why are real-time searches not working with my custom D3.js chart?

Explorer

Hi,

I've created a custom dashboard with D3.js. Under "custom" I mean, that I've taken some chart, that is not present in Splunk by default, but could be added with d3.

Everything works good, but I have real-time searches not working.

The general description of how it works is:

I have a standard Splunk SearchManager that is added to my dashboard and it runs the search. On SearchManager.data() I run the parsing script and pass the resulting JSON to my custom d3 chart.

That works with any timerange except real-time searches.

Does anybody know what should be extended or what object should I customize to solve that problem?

Any advice would be greatly appreciated!

Many thanks in advance!

1 Solution

Champion

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

View solution in original post

Champion

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

View solution in original post

Explorer

Thanks!

Using 'data("preview")' gave what i need, now everything works as desired

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!