topic Blocking searches using splunkJS-stack? in Splunk Search

Blocking searches using splunkJS-stack?

ahmetcepoglu — Mon, 17 Feb 2014 15:54:20 GMT

I have multiple searches, and I need their results in a particular order.

I am trying to make a splunk view that shows results from multiple searches.

I am under the impression that to make it a splunk view, it must be created using splunk web-framework and has django bindings and whatnot. And because of that, it cannot have blocking searches.

I need to be able to retrieve search results in a particular order, so I am going to need blocking searches.

My question is, can I have blocking searches in a splunk-django application?

Re: Blocking searches using splunkJS-stack?

magnew_splunk — Fri, 28 Feb 2014 17:43:37 GMT

Hi ahmetcepoglu,

You can do this using the web-framework, and you don't need to use Django. The web-framework provides Django functionality, but everything is also available from javascript. You can also write an application that mixes Django with JavaScript.

Your scenario can be accomplished by creating searchmanagers and listening to their done events. You'll have Javascript that looks something like this:

var myManager = new SearchManager({
   id: 'myManager'
   search: '<your search here>
});
myManager.on('search:done', function(){
   //start next manager
});

If you want more samples and explanations, the framework toolkit is a good place to start: http://apps.splunk.com/app/1613/

Re: Blocking searches using splunkJS-stack?

ahmetcepoglu — Fri, 28 Feb 2014 19:36:39 GMT

Isn't that nonblocking call?

Re: Blocking searches using splunkJS-stack?

magnew_splunk — Fri, 28 Feb 2014 19:48:27 GMT

Yes, but if your goal is to run searches one after another, you can use it. For each search manager, you can set autostart to false on creation. Then, you can start them when you want by calling startSearch on them. So for instance, if I wanted to run two searches in sequence, I could do something like this:

var myManager = new SearchManager({
id: 'myManager',
search: your search
});

var myManager2 = new SearchManager({
id: 'myManager',
autostart: false,
search: your search
});

myManager.on('search:done', function(){
myManager2.startSearch();
});