Dashboards & Visualizations

Get reults from SearchManager / SplunkJS

gaRe
Explorer

Hello,

iam trying to start a search with Javascript and the SearchManager inside my own js-libary on a Dashboard . My Dashboard-header is binding: splunk.js, myownlibary.js and myOwncss.css. After reading some documentations and some help from here i found out how to call a search with the correct framework, objects and methods.

Iam also using the plugin "DB Connect", with that plugin you can
query directly to the database like: "| dbquery myDB \"(SQL STATEMENT)\""

Now ive got a db-query which works and iam trying to fire it with javascript-code which is also firing when my MutationObserver react by defined events.

So my actual code now is:

 var searchIncrementer = "1";
 require(["splunkjs/ready!"], function(mvc) {
    var deps = [
        "splunkjs/ready!",
        "splunkjs/mvc/searchmanager",
    ];
    require(deps, function(mvc) {

        var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
            id: "mvasearch" + searchIncrementer,
            earliest_time: "-24h@h",
            latest_time: "now",
            search: "| dbquery PrixB limit=1000 \"select * from bild b join shopposition s on                    b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='" + mvaArticleNumber + "'\"",
   });

   var mvaDataObj = splunkjs.mvc.Components.getInstance("mvasearch" + searchIncrementer);

    mvaDataObj.on('search:progress', function(properties) {
        console.log("IN PROGRESS:", properties)
    });

    mvaDataObj.on('search:done', function(properties) {
        console.log("DONE:", properties)
    });

    mvaDataObj.on('search:failed', function(properties) {
        console.log("FAIL:", properties)
    });  

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });
myResults.on("data", function() {
        // The full data object
        console.log(myResults.data());

        // Indicates whether the results model has data
        console.log("Has data? ", myResults.hasData());

        // The results rows
        console.log("Data (rows): ", myResults.data().rows);

     // The Backbone collection
        console.log("Backbone collection: ", myResults.collection());
});
    var tmpIncrementer = parseInt(searchIncrementer);
    tmpIncrementer++;
    searchIncrementer = String(tmpIncrementer);

   }); // require

Its mostly from the examples....

console.log() / IN PROGRESS, DONE

Tells me that there is no error, resultCount: 4 and some links like:

results: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/results"

search.log: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/search.log"

console.log("Has data? ", myResults.hasData());

Is false but why? Also the result from both logs are empty.

I dont get it because the resultCount is 4 so he founds something?
But why are the results empty? Is there a function like "getResultsFromSearch(row, fields)" which you can use by Splunk SDK (Javascript) on jobs?

Thanks..

cafissimo
Communicator

You should try to use

var myResults = mvaDataObj.data("results") ;
myResults.on("data", function() {
                    console.log("Has data? ", myResults.hasData());
                    console.log("Type: ", myChoice);
                    console.log("Data (rows): ", myResults.data().rows);
                    console.log("Backbone collection: (rows) ", myResults.collection().raw.rows);
                });

instead of

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

Let me know if it works!

ineeman
Splunk Employee
Splunk Employee

So in your original call, you have this:

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

And then you say you get four results. Is there a reason you're using "offset=10", which would mean that you won't see any results from 0-10? In this case, if you only have 4 results, you won't see them.

grossb
Explorer

Where are the examples you were referencing to get to this point?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Data Management Digest – September 2026

    Welcome to the September 2026 edition of Data Management Digest! September brought a fresh wave of ...

Federated Search for CloudWatch Unified Data Store Is Generally Available

As organizations modernize their cloud environments, AWS workloads generate more security, operational, and ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...