Dashboards & Visualizations

Get reults from SearchManager / SplunkJS

gaRe
Explorer

Hello,

iam trying to start a search with Javascript and the SearchManager inside my own js-libary on a Dashboard . My Dashboard-header is binding: splunk.js, myownlibary.js and myOwncss.css. After reading some documentations and some help from here i found out how to call a search with the correct framework, objects and methods.

Iam also using the plugin "DB Connect", with that plugin you can
query directly to the database like: "| dbquery myDB \"(SQL STATEMENT)\""

Now ive got a db-query which works and iam trying to fire it with javascript-code which is also firing when my MutationObserver react by defined events.

So my actual code now is:

 var searchIncrementer = "1";
 require(["splunkjs/ready!"], function(mvc) {
    var deps = [
        "splunkjs/ready!",
        "splunkjs/mvc/searchmanager",
    ];
    require(deps, function(mvc) {

        var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
            id: "mvasearch" + searchIncrementer,
            earliest_time: "-24h@h",
            latest_time: "now",
            search: "| dbquery PrixB limit=1000 \"select * from bild b join shopposition s on                    b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='" + mvaArticleNumber + "'\"",
   });

   var mvaDataObj = splunkjs.mvc.Components.getInstance("mvasearch" + searchIncrementer);

    mvaDataObj.on('search:progress', function(properties) {
        console.log("IN PROGRESS:", properties)
    });

    mvaDataObj.on('search:done', function(properties) {
        console.log("DONE:", properties)
    });

    mvaDataObj.on('search:failed', function(properties) {
        console.log("FAIL:", properties)
    });  

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });
myResults.on("data", function() {
        // The full data object
        console.log(myResults.data());

        // Indicates whether the results model has data
        console.log("Has data? ", myResults.hasData());

        // The results rows
        console.log("Data (rows): ", myResults.data().rows);

     // The Backbone collection
        console.log("Backbone collection: ", myResults.collection());
});
    var tmpIncrementer = parseInt(searchIncrementer);
    tmpIncrementer++;
    searchIncrementer = String(tmpIncrementer);

   }); // require

Its mostly from the examples....

console.log() / IN PROGRESS, DONE

Tells me that there is no error, resultCount: 4 and some links like:

results: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/results"

search.log: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/search.log"

console.log("Has data? ", myResults.hasData());

Is false but why? Also the result from both logs are empty.

I dont get it because the resultCount is 4 so he founds something?
But why are the results empty? Is there a function like "getResultsFromSearch(row, fields)" which you can use by Splunk SDK (Javascript) on jobs?

Thanks..

cafissimo
Communicator

You should try to use

var myResults = mvaDataObj.data("results") ;
myResults.on("data", function() {
                    console.log("Has data? ", myResults.hasData());
                    console.log("Type: ", myChoice);
                    console.log("Data (rows): ", myResults.data().rows);
                    console.log("Backbone collection: (rows) ", myResults.collection().raw.rows);
                });

instead of

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

Let me know if it works!

ineeman
Splunk Employee
Splunk Employee

So in your original call, you have this:

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

And then you say you get four results. Is there a reason you're using "offset=10", which would mean that you won't see any results from 0-10? In this case, if you only have 4 results, you won't see them.

grossb
Explorer

Where are the examples you were referencing to get to this point?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Supercharging Windows Security Detection Performance: Introducing Hybrid Field ...

Windows event logs—from Security auditing and Sysmon to PowerShell script blocks—form the operational backbone ...

Ditch the Manual Grind: Building AI Agents with Splunk

Ditch the Manual Grind: Building AI Agents with Splunk Let’s be real: your team’s time is being eaten alive. ...

Cisco Data Fabric from Architecture to Investigation, Better SOC Visibility, and More ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...