Splunk Search

How to Read Query results in JAVA SCRIPT in my View

ma_anand1984
Contributor

I would like to read query results(from Search Module) in my javascript written in my View.

Note: I'm not using js SDK

1 Solution

sideview
SplunkTrust
SplunkTrust

1) Well, the best advice I can give is to use Sideview Utils.

You can take the easy way out with a configuration like this:

<module name="Search">
  <param name="search">searchterms | stats avg(foo) as foo last(bar) as bar max(baz) as baz</param>

  <module name="ResultsValueSetter">
    <param name="fields">foo bar baz</param>

    <module name="CustomBehavior">
      <param name="customBehavior">doSomethingWithResults</param>

    </module>
  </module>
</module>

the ResultsValueSetter module will go get the field value from the first row of search results.

Then the CustomBehavior you can define in application.js

Sideview.utils.declareCustomBehavior("doSomethingWithResults", function(customBehaviorModule) {
    customBehaviorModule.onContextChange = function() {
      var context = this.getContext();
      var foo = context.get("foo");
      var bar = context.get("bar");
      var baz = context.get("baz");
      alert("woohoo! " + foo + ", " + bar + ", " + baz);
  }
});

2) The longer more involved route involves using the JS objects from the Splunk UI directly.

ie if you do

var search = context.get("search");

the "search" key is always an instance of Splunk.Search. Once you have one of these, they have a getUrl method.

var url = search.getUrl("results");

and you get use your method of choice to hit that URL and parse the JSON it returns...

The trick of it is exactly when and where to call that code. The CustomBehavior and ResultsValueSetter and HTML modules and all these guys on the other hand make this stuff pretty easy.

3) And the third option is to go somewhere in the middle. Use the nice CustomBehavior module to make it easier to attach custom code, but instead of using ResultsValueSetter, write your customBehavior to do things onJobDone, onContextChange, onJobProgress, etc, and have it hit the URL's directly and parse JSON etc...

View solution in original post

sideview
SplunkTrust
SplunkTrust

1) Well, the best advice I can give is to use Sideview Utils.

You can take the easy way out with a configuration like this:

<module name="Search">
  <param name="search">searchterms | stats avg(foo) as foo last(bar) as bar max(baz) as baz</param>

  <module name="ResultsValueSetter">
    <param name="fields">foo bar baz</param>

    <module name="CustomBehavior">
      <param name="customBehavior">doSomethingWithResults</param>

    </module>
  </module>
</module>

the ResultsValueSetter module will go get the field value from the first row of search results.

Then the CustomBehavior you can define in application.js

Sideview.utils.declareCustomBehavior("doSomethingWithResults", function(customBehaviorModule) {
    customBehaviorModule.onContextChange = function() {
      var context = this.getContext();
      var foo = context.get("foo");
      var bar = context.get("bar");
      var baz = context.get("baz");
      alert("woohoo! " + foo + ", " + bar + ", " + baz);
  }
});

2) The longer more involved route involves using the JS objects from the Splunk UI directly.

ie if you do

var search = context.get("search");

the "search" key is always an instance of Splunk.Search. Once you have one of these, they have a getUrl method.

var url = search.getUrl("results");

and you get use your method of choice to hit that URL and parse the JSON it returns...

The trick of it is exactly when and where to call that code. The CustomBehavior and ResultsValueSetter and HTML modules and all these guys on the other hand make this stuff pretty easy.

3) And the third option is to go somewhere in the middle. Use the nice CustomBehavior module to make it easier to attach custom code, but instead of using ResultsValueSetter, write your customBehavior to do things onJobDone, onContextChange, onJobProgress, etc, and have it hit the URL's directly and parse JSON etc...

sideview
SplunkTrust
SplunkTrust

If you look inside Sideview Utils itself, look at the application.js file, and you'll see the declarations for a number of customBehaviors there. Search across all the xml files for the customBehavior names, and you'll find the testcase views and documentation views that use them. Beyond that there are custombehavior examples in other apps that use Sideview Utils - for instance SoS.

0 Karma

kasu_praveen
Communicator

I was looking for almost same kind of stuff. Thanks for posting.

Can you describe or provide some examples on above mentioned 3rd option

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...