I have been unable to find an elegant solution for this issue (it looks like Dashboard Studio is not quite "there" yet) but the following technique does work. 1.  Modify data source query by adding a new field: | eval q_appDisplayName = "\"" . appDisplayName . "\"" 2. Modify input definition as follows: "input_hcQWlw8q": {      "title": "Select App",     "type": "input.multiselect",     "options": {         "token": "appDisplayName"         "defaultValue": "*",         "clearDefaultOnSelection": true,         "items": [             {                 "value": "*",                 "label": "All"             }         ]     },     "dataSources": {         "primary": "ds_GQslD2fp"     },     "encoding": {         "value": "primary.q_appDisplayName",         "label": "primary.appDisplayName"     } } ... View more

Thanks for prompt reply which perfectly clarifies the issue. Since we are on this topic, I have another question. Splunk dashboards have a notion of base searches and the feature is easy to use. When developing React App (running on Splunk server) without relying on the Dashboard Framework does any of these APIs offer an easy way to reuse the results of the "base" search for a new search? The only relevant thing I was able to find  is the PostProcessManager in the legacy Splunk Web Framework (https://dev.splunk.com/enterprise/docs/developapps/visualizedata/addsearches). Is this the only option? Perhaps, simply prefixing follow up query with "| loadjob <sid>" would do the trick? ... View more

Ryan, Your posts (here and elsewhere) are greatly appreciated. They really help with learning Splunk UI Kit. I came across this thread while trying to learn more about splunk-utils/search. I am a little bit confused between the different options Splunk offers now for front-end web development. Your post here (https://www.splunk.com/en_us/blog/platform/splunk-ui-and-the-dashboard-framework-more-visual-control-than-ever.html) helps understanding use cases for Dashboard Framework. I also saw a post/article (can't find it anymore) comparing use cases for Dashboard Framework vs conventional React app based on Splunk UI components (like Visualizations). The Dashboard Framework seems a little too heavy for simpler use cases. On the other hand use of individual components has its own issues (I think it does not scale well). At this point I am concentrated on the latter approach. I find it easy to use components from @splunk/react-ui. Use of components from @splunk/visualizations is not as straightforward. It requires  development of a glue code for connecting search results with visualization component (DF might be the answer but it comes with its own tradeoffs). So far I have been using @splunk/search-job for performing the searches. This one is used in some of the examples offered with Splunk UI Kit. But then I came across @splunk/splunk-utils/search. This one seemingly offers the features similar to @splunk/search-job (with more granular control over the search job). This thread is the only place where I found an example of how to use @splunk/splunk-utils/search (and the documentation is just not sufficient for learning how to use this component). Could you elaborate on the target use cases for these two approaches? Thanks in advance. ... View more

Here are my findings: "Would switching to using the /services/search/jobs/export endpoint help"? From the documentation for search/jobs/export endpoint: If it is too big, you might instead run with the search/jobs (not search/jobs/export) endpoint (it takes POST with the same parameters), maybe using the exec_mode=blocking.  So, using export endpoint does not appear to be an option for the search returning a lot of data. "With the 'auto_cancel' parameter what counts as 'inactivity'?" I have no idea but in my testing (setting auto_cancel to 2 in the POST request creating the job) it did not make any difference "Would doing a DELETE /services/search/jobs/{sid} clear up space quicker?" This worked the same way as using POST request on search/jobs/{search_id}/control endpoint (with action=cancel). In Job Manager, the job disappeared after the job execution pretty quickly. In both cases, Splunk returned this: {"messages":[{"type":"INFO","text":"Search job cancelled."}]} I suspect that the same code handles both requests. So, the good thing is that this seems to work but my testing was simple and it may not be able to catch corner cases. For example, if the same search is executed again while the original search is still running, will Splunk delete the first job when it is done? The seconds search might be reading cached results so the request to delete the first job might be rejected. And what will happen to the delete/cancel request after the second search is done?  ... View more

I am facing the exactly same issues. Our technique for getting the search results is also exactly the same. In the past we tried using export, Splunk Python SDK and a few other things. We had issues with all of them for searches that return a lot of data (millions of events, GBs of data). Have you found a solution?  ... View more

Thanks a lot for sharing. I did most of the things you mentioned. However points 1 and 2 are invaluable. I just joined the Slack group (and now I have to learn Slack in addition to everything else :-). I am going to research what's there and proceed with my project. ... View more

I am interested in this issue too. I followed the instructions for building a ReactJS based UI provided at .conf19.  One of the presentations I used was DEV2165 (Deep Dive on The New Dashboarding and Content Export Experience). I am trying to use ReactJS for building a Splunk app. It defines a React component that hosts a Dashboard (using @splunk/dashboard-* modules) and other React components.  My first observation is that Splunk basically stopped publishing any materials/documentations on this subject after .conf19. The documentation is severely lacking. It is not clear if Splunk is committed to making this technique (ReactJS) available to the customers. That said, I was able to implement a dashboard using the techniques described in the the aforementioned presentation. Next step for me is to integrate custom React-based UI with the dashboard. I tried using Splunk JS just like Stjubit. I did not get as far as Julian did though (my experience with React/WebPack and web development in general is rather limited). Presentation slides say this about the issue: Other Advanced Use Cases Token, namespaces, filters • Similar to how they work in SimpleXML Event handlers • Create and register event handlers triggered by keyboard, mouse or other events • Example: drilldown to url Theming • Dark theme Basically that's all I was able to find about it. And it does not work. From my experience so far with this new ReactJS based library, it appears that the best case scenario is going to be that the Dashboard customization opportunities are going to be as limited as they were with SplunkJS, which makes me think about using ReactJS without the Splunk's Dashboard components and relying on a third party visualization library instead. I would still need to figure out how to perform Splunk searches for this app (in the context of a Splunk app).   It is not clear if the legacy SplunkJS is supposed to be used with ReactJS or there is/will be a new API for that. I noticed that Splunk added a new module (splunk-sdk-js) to NPM repository two days ago. Could this be something that we might use? NPM refused to install it for me though. ... View more

Eylon, I came across your post on Medium before I found this one. I was looking for information about integrating React and Splunk (using the new Dashboard Framework). Being a newcomer to both React and Splunk, this task is also impossible and it is definitely taking me way more than a week to come up with a simple dashboard. I followed the examples that I was able to find elsewhere but there is almost nothing out there. Splunk did provide some examples at .conf19 but not much after that. Those examples came with @splunk/dashboard-core 8.x.x. The current version of this component is 20.1.0. Obviously it was changed a lot. I am running into some issues with React and I suspect that it may have something to do with incompatibility between the versions of React and @splunk/dashboard-* stuff in my build. But I can find any information about the right configuration (the package.json from the examples might work but it's an extremely outdated version). Did you use @splunk/dashboard-* modules? Could you share a little bit more about your experience?   ... View more

Have you been able to root cause this issue? I have come across a similar one. When using Python SDK, jobs.export and BufferedReader (reader = results.ResultsReader(io.BufferedReader(search_results)), on some occasions I get the following exception: Traceback (most recent call last): File ".../splunk_event_editor.py", line 747, in search_and_modify self._get_field_types_from_splunk(search_query, sampling=sampling, no_change_stop=2000) File ".../ams/splunk_event_editor.py", line 434, in _get_field_types_from_splunk for item in reader: File ".../python3.7/site-packages/splunklib/results.py", line 210, in next return next(self._gen) File ".../python3.7/site-packages/splunklib/results.py", line 219, in _parse_results for event, elem in et.iterparse(stream, events=('start', 'end')): File ".../python3.7/xml/etree/ElementTree.py", line 1222, in iterator yield from pullparser.read_events() File ".../python3.7/xml/etree/ElementTree.py", line 1297, in read_events raise event File ".../python3.7/xml/etree/ElementTree.py", line 1269, in feed self._parser.feed(data) xml.etree.ElementTree.ParseError: not well-formed (invalid token): line 51128, column 3080 The same code/query usually works a moment later so I suspect that it may have something to do with the fact that the new events matched by the search query might be arriving (via HTTP Event Collector) during the execution of the export. ... View more

I am also studying the ReactJS app presented at .conf19. Is there any documentation for  Splunk components for ReactJS? Are these components officially supported by Splunk? Obviously, without official support use ReactJS components would not be an option for most projects. ... View more