All Apps and Add-ons

Unexpected Behavior - outputlookup not working unless results called

snoobzilla
Builder

I was trying to have a kind of hidden update to track usage of a support search form. To do so I tried putting a simple outputlookup followed by a null module. Didn't work. Then just before a redirector to another page. Did not work.

After hours of why isn't this working... I think I have the answer. You must call the results of search for the outputlookup to actually write results to the file. Weird. Maybe it is the same in advanced xml, not sure, I use sideview for pretty much everything.

Per answer below this is not a sideview issue.

0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

It's not because something needs to call the results of the search. Rather, it's because there need to be some "dispatching modules" aka modules that require search results in an abstract sense, for the framework to actually dispatch the search at all.

This is actually explained in full detail on the second page in the Sideview Utils docs - "Introduction to the Advanced XML". Now that you've got a lot of real experience building stuff, go back and read that page again.

The "Search" module doesn't actually dispatch a search (actually it doesn't know anything at all about the existence of dispatched searches tbh). Rather it just supplies the search string and/or timerange arguments downstream. It's only later in those downstream modules where the framework looks at it all and says "oh dear. this JobProgressIndicator isn't going to be able to do its job unless I roll up all these arguments right.... here".

Therefore, to do advanced things like to sneak hidden dispatching componentry into a page... you have to be a little sneaky. This will do it.

<module name="CustomBehavior">
  <param name="requiresDispatch">True</param>
</module>

As for what's going on with the Redirector, It's not clear from the description. If you can expand or ask it as a separate question I'll try and answer.

View solution in original post

sideview
SplunkTrust
SplunkTrust

It's not because something needs to call the results of the search. Rather, it's because there need to be some "dispatching modules" aka modules that require search results in an abstract sense, for the framework to actually dispatch the search at all.

This is actually explained in full detail on the second page in the Sideview Utils docs - "Introduction to the Advanced XML". Now that you've got a lot of real experience building stuff, go back and read that page again.

The "Search" module doesn't actually dispatch a search (actually it doesn't know anything at all about the existence of dispatched searches tbh). Rather it just supplies the search string and/or timerange arguments downstream. It's only later in those downstream modules where the framework looks at it all and says "oh dear. this JobProgressIndicator isn't going to be able to do its job unless I roll up all these arguments right.... here".

Therefore, to do advanced things like to sneak hidden dispatching componentry into a page... you have to be a little sneaky. This will do it.

<module name="CustomBehavior">
  <param name="requiresDispatch">True</param>
</module>

As for what's going on with the Redirector, It's not clear from the description. If you can expand or ask it as a separate question I'll try and answer.

sideview
SplunkTrust
SplunkTrust

No no - you literally put that CustomBehavior module, as is, downstream from the search you want dispatched, and that's it. Don't worry about anything else. Normally CustomBehavior is used to attach custom behavior as implemented in custom Javascript, but here you're not going to do that. The mere presence of the module, with that one param, will resolve your problem. You don't call the customBehavior or worry about it anywhere else.

snoobzilla
Builder

Ok... I put it downstream where I had the html that was dispatching the search, that worked. Seems like I should be able to call the custom behavior directly in the custom behavior field of the search or other modules...

0 Karma

snoobzilla
Builder

Thanks for the info. Will try it out... I am a custom behavior rookie... I did read docs but didn't click yet.

Is this right? I put that module upstream and then I can call it in the custom behavior param of the downstream modules... e.g. these searches? Can I use this on the job progress indicators too?

I will play with it and see what happens.

Redirector is fine, it was just another module I put downstream that did not result in the search being dispactched because I wasn't using the 'hidden' search results in the redirect.

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...