Dashboards & Visualizations

Get reults from SearchManager / SplunkJS

gaRe
Explorer

Hello,

iam trying to start a search with Javascript and the SearchManager inside my own js-libary on a Dashboard . My Dashboard-header is binding: splunk.js, myownlibary.js and myOwncss.css. After reading some documentations and some help from here i found out how to call a search with the correct framework, objects and methods.

Iam also using the plugin "DB Connect", with that plugin you can
query directly to the database like: "| dbquery myDB \"(SQL STATEMENT)\""

Now ive got a db-query which works and iam trying to fire it with javascript-code which is also firing when my MutationObserver react by defined events.

So my actual code now is:

 var searchIncrementer = "1";
 require(["splunkjs/ready!"], function(mvc) {
    var deps = [
        "splunkjs/ready!",
        "splunkjs/mvc/searchmanager",
    ];
    require(deps, function(mvc) {

        var SearchManager = require("splunkjs/mvc/searchmanager");
        new SearchManager({
            id: "mvasearch" + searchIncrementer,
            earliest_time: "-24h@h",
            latest_time: "now",
            search: "| dbquery PrixB limit=1000 \"select * from bild b join shopposition s on                    b.bildnummer=s.bildnummer\n join shoppositionartikelgruppe spag on s.datensatznummer=spag.shopposinummer\n join artikelnummer artnr on artnr.artikelgruppennummer=spag.artikelgruppennummer\n where artnr.artikelnummer='" + mvaArticleNumber + "'\"",
   });

   var mvaDataObj = splunkjs.mvc.Components.getInstance("mvasearch" + searchIncrementer);

    mvaDataObj.on('search:progress', function(properties) {
        console.log("IN PROGRESS:", properties)
    });

    mvaDataObj.on('search:done', function(properties) {
        console.log("DONE:", properties)
    });

    mvaDataObj.on('search:failed', function(properties) {
        console.log("FAIL:", properties)
    });  

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });
myResults.on("data", function() {
        // The full data object
        console.log(myResults.data());

        // Indicates whether the results model has data
        console.log("Has data? ", myResults.hasData());

        // The results rows
        console.log("Data (rows): ", myResults.data().rows);

     // The Backbone collection
        console.log("Backbone collection: ", myResults.collection());
});
    var tmpIncrementer = parseInt(searchIncrementer);
    tmpIncrementer++;
    searchIncrementer = String(tmpIncrementer);

   }); // require

Its mostly from the examples....

console.log() / IN PROGRESS, DONE

Tells me that there is no error, resultCount: 4 and some links like:

results: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/results"

search.log: "/servicesNS/-/-/search/jobs/user__user__app__mvasearch229_1389779059.39108/search.log"

console.log("Has data? ", myResults.hasData());

Is false but why? Also the result from both logs are empty.

I dont get it because the resultCount is 4 so he founds something?
But why are the results empty? Is there a function like "getResultsFromSearch(row, fields)" which you can use by Splunk SDK (Javascript) on jobs?

Thanks..

cafissimo
Communicator

You should try to use

var myResults = mvaDataObj.data("results") ;
myResults.on("data", function() {
                    console.log("Has data? ", myResults.hasData());
                    console.log("Type: ", myChoice);
                    console.log("Data (rows): ", myResults.data().rows);
                    console.log("Backbone collection: (rows) ", myResults.collection().raw.rows);
                });

instead of

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

Let me know if it works!

ineeman
Splunk Employee
Splunk Employee

So in your original call, you have this:

var myResults = mvaDataObj.data("preview", { count: 25, offset: 10 });

And then you say you get four results. Is there a reason you're using "offset=10", which would mean that you won't see any results from 0-10? In this case, if you only have 4 results, you won't see them.

grossb
Explorer

Where are the examples you were referencing to get to this point?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...