- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Re: splunk6 custom HTML visualization not updating...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
I've written a custom view in Splunk6 that shows me search results as plain HTML content.
The simple xml view works and shows my html content when the page loads. But if I try to use form inputs such as a dropdown, the view doesn't update when I hit the submit button.
I've basically copy/pasted the examples from Splunk6 custom visualization examples, the code looks as follows:
following code gives me a dropdown with a list of splunk apps:
<fieldset autoRun="true">
<input type="dropdown" token="app_name" searchWhenChanged="false">
<label>Select an App:</label>
<populatingSearch fieldForValue="app" fieldForLabel="app">
<![CDATA[ | script python splunksvn -v ]]>
</populatingSearch>
</input>
[...]
</fieldset>
following code integrates my custom visualization:
[...]
<html>
<h2>local svn diff</h2>
<div id="htmlcontent-diffsearch"
class="splunk-manager splunk-searchmanager "
data-require="splunkjs/mvc/searchmanager"
data-options='{
"app": "subversion",
"preview": true,
"search": { "type": "token_safe", "value": "| script python splunksvn -c $app_name$}
}'>
</div>
<div id="htmlcontent-diff"
class="splunk-view"
data-require="app/subversion/components/htmlcontent/htmlcontent"
data-options='{
"managerid": "htmlcontent-diffsearch"
}'>
</div>
</html>
[...]
In my htmlcontent.js file I've basically just implemented the "updateView" function:
[...]
updateView: function(viz, data) {
var myResults = data[0]; // Sets this to the first (and only) row
this.$el.html(myResults);
}
[...]
I suspect that the "html" element in simple xml doesn't know anything about the submit action. But how can I tell my view to update?
Kind regards
mathu
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using double dollar signs for the token in the search string helped...
changing:
"search": { "type": "token_safe", "value": "| script python splunksvn -c $app_name$ }
to:
"search": { "type": "token_safe", "value": "| script python splunksvn -c $$app_name$$ }
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, this worked for me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Using double dollar signs for the token in the search string helped...
changing:
"search": { "type": "token_safe", "value": "| script python splunksvn -c $app_name$ }
to:
"search": { "type": "token_safe", "value": "| script python splunksvn -c $$app_name$$ }
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I do have the same issue (my impression) as the question asker and when i try this trick with the double $ then i will never ever get a result :-=)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you aware that your "value": "| script... doesn't have a closing quotation mark? Could that be the problem, or is it just a copy/paste artifact?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This worked for me thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
.. by the way, the code works with all ohter elements (such as table, chart, single). "html" seems to be the only element not reacting on form changes
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
