Dashboards & Visualizations

Can I cache searches in Simple XML using the method available in an HTML/JavaScript dashboard?

kierencrossland
Path Finder

I have a dashboard that I have created using simple XML, there are several graphs that have search in like this:

<search>
  <query>search ...</query>
  <earliest>-15m</earliest>
  <latest>now</latest>
</search>

I would like to be able to cache these searches in the same way that I can if I convert the simple XML dashboard to HTML/JavaScript by setting the cache option (see '"cache": 900' in the example below). Does anyone know if this is possible without having to convert to HTML?

        var search1 = new SearchManager({
            "id": "search1",
            "latest_time": "now",
            "earliest_time": "-15m",
            "search": "search...",
            "status_buckets": 0,
            "cancelOnUnload": true,
            "app": utils.getCurrentApp(),
            "auto_cancel": 90,
            "preview": true,
            "runWhenTimeIsUndefined": false,
            "cache": 900
        }, {tokens: true, tokenNamespace: "submitted"});
1 Solution

piUek
Path Finder

You can change the cache parameter of the search from the simplexml.
To do this attach the js to your root dashboard / form element in the simplexml file:

<dashboard script="test.js">

Also add the id to Your search:

<search id="mysearch">

Then create the script file named test.js in your appdirectory/appserver/static/test.js

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc, ignore) {
    // grab the mysearch handler:
    var mysearch = mvc.Components.getInstance('mysearch')

    // set cache to 900
    mysearch.set('cache', 900);

    // print cache value to console
    console.log(mysearch.get('cache'));
});

This works for splunk 6.3 - with the added scrpit id attribute. Without this You'd have to get search id (maybe with method mvc.Components.getInstanceNames().

More reliable would be building your dashboard using JavaScript. There is a guide for doing this: http://dev.splunk.com/view/SP-CAAAE4A, examples page: http://dev.splunk.com/view/SP-CAAAEU7#xmlextensions and basic example for starters: http://dev.splunk.com/view/SP-CAAAE4M.

Using JavaScript extensions You'll get full control of the page.

View solution in original post

piUek
Path Finder

You can change the cache parameter of the search from the simplexml.
To do this attach the js to your root dashboard / form element in the simplexml file:

<dashboard script="test.js">

Also add the id to Your search:

<search id="mysearch">

Then create the script file named test.js in your appdirectory/appserver/static/test.js

require([
    "splunkjs/mvc",
    "splunkjs/mvc/simplexml/ready!"
], function(mvc, ignore) {
    // grab the mysearch handler:
    var mysearch = mvc.Components.getInstance('mysearch')

    // set cache to 900
    mysearch.set('cache', 900);

    // print cache value to console
    console.log(mysearch.get('cache'));
});

This works for splunk 6.3 - with the added scrpit id attribute. Without this You'd have to get search id (maybe with method mvc.Components.getInstanceNames().

More reliable would be building your dashboard using JavaScript. There is a guide for doing this: http://dev.splunk.com/view/SP-CAAAE4A, examples page: http://dev.splunk.com/view/SP-CAAAEU7#xmlextensions and basic example for starters: http://dev.splunk.com/view/SP-CAAAE4M.

Using JavaScript extensions You'll get full control of the page.

kierencrossland
Path Finder

Thanks piUek, I didnt realise I could extend simple xml like that.

Usually in this situation I would convert the dashboard to html/js, or use web frameworrk, but in doing this you lose some simplicity in maintaining the dashboard. I like the idea of keeping the dashboard in simple xml where possible, so using a javascript extension seems like the perfect solution.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...