Splunk® Enterprise

Module System Reference

Acrobat logo Download manual as PDF

Splunk Enterprise version 7.2 is no longer supported as of April 30, 2021. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. Click here for the latest version.
Acrobat logo Download topic as PDF


Important notice: As part of Advanced XML deprecation, the Module System is officially deprecated beginning with Splunk Enterprise 6.3. For more information, see Advanced XML Deprecation.


The generateResults() method is called by the app server to generate module HTML content in response to a GET request.

The base class method is not implemented. Override generateResults() to provide module-specific content information.

The args parameter is a dictionary of all URI query string parameters that can be passed from the UI. The response HTML fragment is returned with the method call.

By default, the getResults() method retrieves data produced by generateResults(), using the @route() decorator.


results = generateResults(args)


args Dict Dictionary of URI name-value pair GET request parameters. Example: args['host_app'] = host_app_value

Return Value

String Success: The HTML fragment to render.
Error: Error message.
Default error message: ' This module does not have a registered renderer.'


User-defined, as needed.



def generateResults(self, host_app=None, client_app=None, savedSearchName=None):

       if savedSearchName: 
           jsonSearch = None
           owner = 'nobody'
               savedSearchObject =
                   splunk.search.getSavedSearch(label = savedSearchName,
                       namespace = client_app,
                       owner = owner)
               jsonSearch =
                       savedSearchObject = savedSearchObject,
                       hostPath = splunk.mergeHostPath(),
                       namespace = client_app,
                       owner = owner)
               job = splunk.search.getJobForSavedSearch(
               if (job):
                   jsonSearch["job"] = job.toJsonable(timeFormat='unix')
               return json.dumps(jsonSearch)
           except Exception, e:
               return ""
           logger.warn('savedSearchName was not passed from the caller')
           return ""

Last modified on 12 August, 2019

This documentation applies to the following versions of Splunk® Enterprise: 6.5.7, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters