diff --git a/packages/react-components/src/components/ConfigurationCompletedStep.tsx b/packages/react-components/src/components/ConfigurationCompletedStep.tsx
index 78a2edf..c1e7f43 100644
--- a/packages/react-components/src/components/ConfigurationCompletedStep.tsx
+++ b/packages/react-components/src/components/ConfigurationCompletedStep.tsx
@@ -1,6 +1,6 @@
-import React, { FC } from 'react';
+import React, { FC, useEffect, useState } from 'react';
import Button from './Button';
-import { getFlareDataUrl } from '../utils/setupConfiguration';
+import { getFlareSearchDataUrl } from '../utils/setupConfiguration';
import ArrowRightIcon from './icons/ArrowRightIcon';
import './ConfigurationGlobalStep.css';
@@ -10,6 +10,12 @@ const ConfigurationCompletedStep: FC<{
tenantName: string;
onEditConfigurationClick: () => void;
}> = ({ show, tenantName, onEditConfigurationClick }) => {
+ const [flareSearchUrl, setFlareSearchUrl] = useState('');
+
+ useEffect(() => {
+ getFlareSearchDataUrl().then((url) => setFlareSearchUrl(url));
+ }, []);
+
return (
@@ -23,7 +29,7 @@ const ConfigurationCompletedStep: FC<{
Edit Configuration
diff --git a/packages/react-components/src/models/splunk.ts b/packages/react-components/src/models/splunk.ts
index 8fe488b..bed3172 100644
--- a/packages/react-components/src/models/splunk.ts
+++ b/packages/react-components/src/models/splunk.ts
@@ -21,6 +21,12 @@ export interface SplunkIndex {
name: string;
}
+export interface SplunkSavedSearch {
+ name: string;
+ qualifiedPath: string;
+ update: (properties: Record) => void;
+}
+
export interface SplunkAppAccessor {
reload: () => void;
}
@@ -66,6 +72,13 @@ export interface SplunkIndexesAccessor {
list: () => Array;
}
+export interface SplunkSavedSearchAccessor {
+ fetch: () => SplunkSavedSearchAccessor;
+ create: (indexName: string, data: any) => void;
+ item: (indexName: string) => SplunkSavedSearch;
+ list: () => Array;
+}
+
export interface SplunkStoragePasswordAccessors {
fetch: () => SplunkStoragePasswordAccessors;
item: (applicationName: string) => SplunkAppAccessor;
@@ -79,6 +92,7 @@ export interface SplunkService {
apps: () => SplunkAppsAccessor;
storagePasswords: () => SplunkStoragePasswordAccessors;
indexes: () => SplunkIndexesAccessor;
+ savedSearches: () => SplunkSavedSearchAccessor;
get: (splunkUrlPath: string, data: any) => void;
post: (
splunkUrlPath: string,
diff --git a/packages/react-components/src/utils/setupConfiguration.ts b/packages/react-components/src/utils/setupConfiguration.ts
index bd5772a..96e1068 100644
--- a/packages/react-components/src/utils/setupConfiguration.ts
+++ b/packages/react-components/src/utils/setupConfiguration.ts
@@ -16,6 +16,7 @@ const applicationNameSpace: SplunkApplicationNamespace = {
app: appName,
sharing: 'app',
};
+const flareSavedSearchName = 'Flare Search';
async function completeSetup(splunkService: SplunkService): Promise {
await updateConfigurationFile(splunkService, 'app', 'install', {
@@ -35,8 +36,11 @@ function getRedirectUrl(): string {
return `/app/${appName}`;
}
-function getFlareDataUrl(): string {
- return `/app/${appName}/search?q=search%20source%3D"flare"`;
+async function getFlareSearchDataUrl(): Promise {
+ const service = createService();
+ const savedSearches = await promisify(service.savedSearches().fetch)();
+ const savedSearch = savedSearches.item(flareSavedSearchName);
+ return `/app/${appName}/@go?s=${savedSearch.qualifiedPath}`;
}
function redirectToHomepage(): void {
@@ -104,7 +108,6 @@ async function saveConfiguration(
isIngestingMetadataOnly: boolean
): Promise {
const service = createService();
-
const storagePasswords = await promisify(service.storagePasswords().fetch)();
await savePassword(storagePasswords, PasswordKeys.API_KEY, apiKey);
await savePassword(storagePasswords, PasswordKeys.TENANT_ID, `${tenantId}`);
@@ -114,10 +117,29 @@ async function saveConfiguration(
`${isIngestingMetadataOnly}`
);
await saveIndexForIngestion(service, indexName);
+ await updateSavedSearchQuery(
+ service,
+ flareSavedSearchName,
+ `source=${appName} index=${indexName}`
+ );
await completeSetup(service);
await reloadApp(service);
}
+async function updateSavedSearchQuery(
+ service: SplunkService,
+ savedSearchName: string,
+ query: string
+): Promise {
+ const savedSearches = await promisify(service.savedSearches().fetch)();
+ const savedSearch = savedSearches.item(savedSearchName);
+ if (savedSearch) {
+ await savedSearch.update({
+ search: query,
+ });
+ }
+}
+
async function fetchCollectionItems(): Promise {
const service = createService();
return promisify(service.get)('storage/collections/data/event_ingestion_collection/', {})
@@ -242,7 +264,7 @@ export {
fetchIngestMetadataOnly,
redirectToHomepage,
getRedirectUrl,
- getFlareDataUrl,
+ getFlareSearchDataUrl,
createFlareIndex,
fetchAvailableIndexNames,
fetchCurrentIndexName,