ER: Add a way to manually launch the search

[martin_mueller]

Promising app so far, but it seems to flood Splunk with search jobs while typing... so my enhancement request: A search button 🙂

[hylam]

I am expecting something like ":w" or submit button.

[Nicolo_Figiani]

Hello everyone,
I can confirm that he cancelling of search jobs doesn't seem to work for me either, since many search jobs are created (and not all of them are deleted) while typing (about every 2 secs).
I thinks this app is very promising but I guess a search button is a required feature to let it work at best.

Great works indeed regarding the development of this app, hope to hear any feedback on this matter soon...

N.

[sni_splunk]

I am the author of this app. Thanks for suggestion, I am happy to add this feature later.

Currently, while you type, a search will be submitted to Splunk, and if you keep typing, the client will cancel previously submitted search if it is still running so there won't be any orphan search job left and consuming resource. However, as I mentioned in the user guide page, it is recommended to develop and verify the SPL against a small data set so that the editor can give you a quick feedback without burning huge resource.

[martin_mueller]

The cancelling of search jobs doesn't seem to work for me. I've just upgraded to 1.0.1 and started typing this simple search:

earliest=-d latest=now index=_internal

After a few minutes, some partial searches were still running and others ran for way too long to suggest they were cancelled. For example, the search earliest ran for over a minute, looking for the token earliest in all my default indexes over all time. I sure didn't wait a minute to type on, please check if this cancelling thing actually works.

[sni_splunk]

Thanks for the feedback. I don't implement the canceling by myself, instead, it is a feature in Splunk's JavaScript library API, but it is probably I did not use it correctly or it is not working as I expected, and I will take a close look at it. Maybe a search button is the ultimate solution to this problem 🙂