Splunk Dev

Splunk Django WebFramework : Cascading Form & Search

koshyk
Super Champion

I was trying to build a django based web front-end using the examples shown in "Splunk Web Framework Toolkit". The example shown for cascaded form is "technically" NOT a cascading search, but rather searches the "whole" data every single time.
Original Example.

    {% block managers %}
    {% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
    {% searchmanager id="sourcetypesearch" search="| metadata index=$index$ OR index=_$index$ type=sourcetypes"|token_safe
    cache=True preview=True autostart=False %}
    {% endblock managers %}

What it means is: The search is run everytime with value from previous selection. So its not actually cascading the search, but rather redoing the entire search !!.
Is there a way we can "cascade" the search too as we do in advanced XML (or sideviewutils) ?

I'm looking for something like..

{% block managers %}
{% searchmanager id="indexsearch" search="| eventcount summarize=false index=* OR index=_*" cache=True preview=False %}
{% searchmanager id="sourcetypesearch" search=$indexsearch$|token_safe
cache=True preview=True autostart=False %}
{% endblock managers %}

whereby the whole of "indexsearch" is passed as a token to the next search , rather than searching the whole once again?

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Why not a Post Process manager?

{% postprocessmanager
    id="sourcetypesearch"
    managerid="indexsearch"
    search="search <your_next_search>" %}

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Why not a Post Process manager?

{% postprocessmanager
    id="sourcetypesearch"
    managerid="indexsearch"
    search="search <your_next_search>" %}

koshyk
Super Champion

Perfect thanks. Didn't know we could use all functionalities in django.
Thanks mate

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Observability Simplified: Combining User Experience, Application Performance & ...

Tech Talk Observability Simplified: Combining User Experience, Application Performance & Network ...

Event Series May & June: From Network Visibility to Service Intelligence

Unifying the Network: Moving from Alert Noise to Service Intelligence with Splunk ITSI In today’s hybrid ...