Splunk Search

How to: Splunk without any formatting?

bkeif
Path Finder

Hello,

So I have written a very simple Django app that displays a basic HTML and CSS webpage. The only reference to splunk is "{% load splunkmvc %}" at the top of my home.html. What I want is the ability to perform searches on this page and display the results in plain text only, no splunk formatting or styling at all.

Right now If I add a query in the {% block managers%} section and reference that query in the HTML I get no results. However, If I add {% extends "splunkdj:base_with_basic_styles.html" %} then the query will work and return results...only they are formated by splunk. Rather than just giving me the single value I want it generates several div's nested in each other and imposes several CSS classes on them from some place I've never referenced producing a large box on my webpage with bold text displaying the result.

What are the bare minimum requirements to perform a splunk search? (ie. a couple JavaScript files I could include in the {% block js %} or something of the sort)

Is this even possible?

Thanks

Here is my search:

{% block managers%}
{% searchmanager
id="search_total"
search="| metadata type=sourcetypes index=* | stats sum(totalCount)"
%}
{% endblock managers%}

Here is how I reference it within the body of the HTML:

{% single id="total" managerid="search_total" %} total events.

This is what I have to add to the HTML to get results (also produces undesired formatting):

{% extends "splunkdj:base_with_basic_styles.html" %}

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

You can do the entire search manager creation and result handling with Javascript. You should check out this overview and from there do the tutorials on the right to see how it works.

View solution in original post

jeffland
SplunkTrust
SplunkTrust

You can do the entire search manager creation and result handling with Javascript. You should check out this overview and from there do the tutorials on the right to see how it works.

bkeif
Path Finder

Thank you much for your reply. I will look into this as work allows.

Update: Much appreciated! This appears to be exactly what I was looking for. I'm not sure how I missed it during my documentation perusing.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...