Splunk Search

Why are real-time searches not working with my custom D3.js chart?

mr_brightside
Explorer

Hi,

I've created a custom dashboard with D3.js. Under "custom" I mean, that I've taken some chart, that is not present in Splunk by default, but could be added with d3.

Everything works good, but I have real-time searches not working.

The general description of how it works is:

I have a standard Splunk SearchManager that is added to my dashboard and it runs the search. On SearchManager.data() I run the parsing script and pass the resulting JSON to my custom d3 chart.

That works with any timerange except real-time searches.

Does anybody know what should be extended or what object should I customize to solve that problem?

Any advice would be greatly appreciated!

Many thanks in advance!

1 Solution

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

For something this simple, it took me quite some time to find it... all you need to do is get the "preview" data from the search manager instead of the "result" data when working with a realtime search:

var search = splunkjs.mvc.Components.getInstance("search1"); // get the search manager
var myResults = search.data("preview"); // get the preview data from that search

After that, you can simply use myResults.on("data", ... as you would normally do.

I stumbled across this fact in this splunk blog post; I failed to find any official documentation for this. Maybe it would be a good idea to incorporate this somewhere, for example here or here.

mr_brightside
Explorer

Thanks!

Using 'data("preview")' gave what i need, now everything works as desired

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...