- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Get data from table from javascript
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello!
I had a simple XML app in SPLUNK.
I need to get all data from rendered table ( or before rendering ), like raw data, of rows, or something else.
And if data rows or columns more then, for example, 100, don't render this table.
How can i do it from my Javascript?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.
The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.
PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.
<form>
<label>Hide Table if more than 100 results</label>
<fieldset submitButton="false">
<input type="text" token="tokNumberOfRows" searchWhenChanged="true">
<label>Number of rows to be returned (for testing)</label>
<default>100</default>
<prefix>| head </prefix>
</input>
</fieldset>
<row>
<panel depends="$showTable$">
<title>Table to be displayed only if less than 100 rows</title>
<table>
<search>
<query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<condition match="$job.resultCount$<101">
<set token="showTable">true</set>
</condition>
<condition>
<unset token="showTable"></unset>
</condition>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<html rejects="$showTable$">
<div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
</html>
</panel>
</row>
</form>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@creemer, you can do this directly in SimpleXML, refer to the following run anywhere dashboard.
The <done> search event handler uses predefined job token $job.resultCount$ to display the table only if search returns up to 100 rows. Also refer to Splunk Dashboard Examples app which has Null Search Swapper example explaining similar scenario.
PS: I have added test box to test the condition and also displaying an additional html panel to be displayed in case table is not being displayed.
<form>
<label>Hide Table if more than 100 results</label>
<fieldset submitButton="false">
<input type="text" token="tokNumberOfRows" searchWhenChanged="true">
<label>Number of rows to be returned (for testing)</label>
<default>100</default>
<prefix>| head </prefix>
</input>
</fieldset>
<row>
<panel depends="$showTable$">
<title>Table to be displayed only if less than 100 rows</title>
<table>
<search>
<query>index="_internal" sourcetype="splunkd" log_level="*"
| stats count by message $tokNumberOfRows$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
<done>
<condition match="$job.resultCount$<101">
<set token="showTable">true</set>
</condition>
<condition>
<unset token="showTable"></unset>
</condition>
</done>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="refresh.display">progressbar</option>
<option name="rowNumbers">true</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
<panel>
<html rejects="$showTable$">
<div>Table is hidden when more than 100 rows returned. This panel can be displayed if more than 100 rows returned</div>
</html>
</panel>
</row>
</form>
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It very good option! THX for answer!
But anyway, how can I handle this by JavaScript?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@creemer, yes it is possible. Just convert the dashboard to HTML Dashboard and it will generate corresponding JavaScript using Splunk Web Framework. You can take out the JavaScript code you need from there. Please let me know if you need any help with JavaScript piece.
| makeresults | eval message= "Happy Splunking!!!"
Introducing the Splunk Community Dashboard Challenge!
Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...
Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...
