How to create a search manager using Django Bindings

Django Bindings has been deprecated. For more, see the Deprecation Notice.

The Django template tags make it really easy to work with search managers, which are defined within the managers block of a template. The different template tags you can use correspond to the different types of searches you can create:

  • To set up a search job, create a SearchManager using the {% searchmanager %} template tag.
  • To use a saved report, create a SavedSearchManager using the {% savedsearchmanager %} template tag.
  • To set up a post-process search based on another search, create a PostProcessManager using the {% postprocessmanager %} template tag.

Here's an example of defining two search managers using tags, the first for a search job and the second for a saved report:

...
{% block managers %}
    {% searchmanager
        id="search1"
        search="index=_internal sourcetype=splunkd | head 1000"
        earliest_time="-24h@h"
        latest_time="now"
        cache=False
        preview=False %}
    {% savedsearchmanager
        id="search2"
        searchname="Top five sourcetypes"
        app="search" %}
{% endblock managers %}
...

For a list of the different properties, methods, and events you can use with search managers, see the Splunk Web Framework Component Reference.

Here's an example of a search with two post-process searches. The post-process searches are linked to the main search by referring to its ID ("main-search") in the managerid property:

...
{% block managers %}
    {% searchmanager
        id="main-search"
        search="index=_internal sourcetype=* | head 10000 | stats count by sourcetype"
        preview=True
        cache=True %}
    {% postprocessmanager
        id="postproc1"
        managerid="main-search"
        search="search sourcetype=splunkd_access OR sourcetype=splunkd" %}
    {% postprocessmanager
        id="postproc2"
        managerid="main-search"
        search="search sourcetype=splunk_web_access OR sourcetype=splunk_web_service" %}
{% endblock managers %}
...

The next step is to display the results of these searches or to interact with them. For more, see How to create a Splunk view using Django Bindings.

To programmatically change search properties, listen for events (such as search progress), or access the search data, you'll need to use JavaScript and the SplunkJS Stack component of the Web Framework. For more, see How to create a search manager using SplunkJS Stack.

For a tutorial, see Tutorial: Create an app using Django Bindings.