Splunk Search

Why are real-time searches not working with my custom D3.js chart?

mr_brightside
Explorer

Hi,

I've created a custom dashboard with D3.js. Under "custom" I mean, that I've taken some chart, that is not present in Splunk by default, but could be added with d3.

Everything works good, but I have real-time searches not working.

The general description of how it works is:

I have a standard Splunk SearchManager that is added to my dashboard and it runs the search. On SearchManager.data() I run the parsing script and pass the resulting JSON to my custom d3 chart.

That works with any timerange except real-time searches.

Does anybody know what should be extended or what object should I customize to solve that problem?

Any advice would be greatly appreciated!

Many thanks in advance!

1 Solution

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

mr_brightside
Explorer

Thanks!

Using 'data("preview")' gave what i need, now everything works as desired

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...