Splunk Search

Get data from table from javascript

creemer
Explorer

Hello!
I had a simple XML app in SPLUNK.
I need to get all data from rendered table ( or before rendering ), like raw data, of rows, or something else.
And if data rows or columns more then, for example, 100, don't render this table.
How can i do it from my Javascript?

0 Karma
1 Solution

niketn
Legend

@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.

The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.

PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.

<form>
  <label>Hide Table if more than 100 results</label>
  <fieldset submitButton="false">
    <input type="text" token="tokNumberOfRows" searchWhenChanged="true">
      <label>Number of rows to be returned (for testing)</label>
      <default>100</default>
      <prefix>| head </prefix>
    </input>
  </fieldset>
  <row>
    <panel depends="$showTable$">
      <title>Table to be displayed only if less than 100 rows</title>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$job.resultCount$<101">
              <set token="showTable">true</set>
            </condition>
            <condition>
              <unset token="showTable"></unset>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <html rejects="$showTable$">
        <div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.

The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.

PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.

<form>
  <label>Hide Table if more than 100 results</label>
  <fieldset submitButton="false">
    <input type="text" token="tokNumberOfRows" searchWhenChanged="true">
      <label>Number of rows to be returned (for testing)</label>
      <default>100</default>
      <prefix>| head </prefix>
    </input>
  </fieldset>
  <row>
    <panel depends="$showTable$">
      <title>Table to be displayed only if less than 100 rows</title>
      <table>
        <search>
          <query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
          <done>
            <condition match="$job.resultCount$<101">
              <set token="showTable">true</set>
            </condition>
            <condition>
              <unset token="showTable"></unset>
            </condition>
          </done>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="refresh.display">progressbar</option>
        <option name="rowNumbers">true</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
    <panel>
      <html rejects="$showTable$">
        <div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
      </html>
    </panel>
  </row>
</form>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

creemer
Explorer

It very good option! THX for answer!
But anyway, how can I handle this by JavaScript?

0 Karma

niketn
Legend

@creemer, yes it is possible. Just convert the dashboard to HTML Dashboard and it will generate corresponding JavaScript using Splunk Web Framework. You can take out the JavaScript code you need from there. Please let me know if you need any help with JavaScript piece.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...