How to add search managers to an HTML dashboard

If you want to add a new visualization that displays the events or results of a search, you'll need to add the search to your dashboard separately as a SplunkJS Stack search manager. A search manager encapsulates the search job, which includes the search query and search properties, and handles the operation and lifetime of the search. The type of search manager depends on the type of search:

  • SearchManager corresponds to an inline search.
  • SavedSearchManager corresponds to a saved report.
  • PostProcessManager corresponds to a post-process search.

The search manager libraries are imported by default, so you won't need to add any requirements.

  1. Open your HTML dashboard in a text editor or in Splunk's Source Editor (see How to convert a Splunk dashboard to HTML to learn how).
  2. Find the comment "// Create searches" in the code (see the Walkthrough of the code for a converted HTML dashboard for details).
  3. To add an inline search, add the following block:
  4. var REPLACE_ID = new SearchManager({
        "id": "REPLACE_ID",
        "search": "REPLACE_QUERY",
        // "earliest_time": "0",
        // "latest_time": "now",
        // "app": utils.getCurrentApp(),
        // "cache": "true",
        // "cancelOnUnload": true
    }, {tokens: true});
    

    Replace these variables for the required properties:

    • REPLACE_ID: Provide a unique ID for this search manager. Use the same value for both instances.
    • REPLACE_QUERY: Provide a search query.

    You can also set additional properties (some common ones are included but commented out). For more, see the Splunk Web Framework Component Reference.

  5. To add a saved report, add the following block:
  6. var REPLACE_ID = new SavedSearchManager({
        "id": "REPLACE_ID",
        "searchname": "REPLACE_REPORT_NAME",
        // "app": utils.getCurrentApp(),
        // "cache": "scheduled",
        // "cancelOnUnload": true
    }, {tokens: true});
    

    Replace these variables for the required properties:

    • REPLACE_ID: Provide a unique ID for this search manager. Use the same value for both instances.
    • REPLACE_REPORT_NAME: Provide the name of a saved report.

    You can also set additional properties (some common ones are included but commented out). For more, see the Splunk Web Framework Component Reference.

  7. To add a post-process search, add the following block:
  8. var REPLACE_ID = new PostProcessManager({
        "id": "REPLACE_ID",
        "managerid": "REPLACE_SEARCHID",
        "search": "REPLACE_QUERY"
    }, {tokens: true});
    

    Replace these variables for the required properties:

    • REPLACE_ID: Provide a unique ID for this search manager. Use the same value for both instances.
    • REPLACE_SEARCHID: Provide the ID of the base search.
    • REPLACE_QUERY: Provide a post-process search query.

The next step is to add a visualization to display the data from the search manager. For more, see How to add a visualization to an HTML dashboard.