How to get data from search manager?

[josefa123]

var SearchManager = require("splunkjs/mvc/searchmanager");
        var searchString = '* | JOIN host [ search source="dbmon-dump://SD_DB/RAP" | eval host=device_id]  | stats first(device_id) as DeviceID,first(device_type) as DeviceType, first(rap_id) as RAPID,' +
            'first(store_name) as StoreName,first(address) as Address,first(rap_type) as RAPType,first(region) as Region, first(city) as City,first(cluster) as Cluster,first(trade_area) as TradeArea,' +
            'first(longitude) as Longitude,first(latitude) as Latitude, first(cal) as CAL, first(start_operation_date) as StartOperationDate,first(memUsedPct) as MemoryUsed,first(rKB_PS) as Read, ' +
            'first(wKB_PS) as Write, first(pctSystem) as CPU_Usage, by host| sort -_time';
        new SearchManager({
            id: "cacheSearch",
            earliest_time: "rt-3m",
            latest_time: "rt",
            autostart: true,
            search: searchString,
            preview: true,
            cache: false
        });

This is my search manager. I want to get the data that the search manager returns for my conditional statement.

For exp.
if(mySearch.data.MemoryUsed < 20){...}

Thanks in advance.

[jeffland · Accepted solution]

What you need is access to the search results model. In your case, you would add the following code to your .js:

var myResults = search.data("results"); // get the data from that search
myResults.on("data", function() {
    resultArray = myResults.data().rows;
    // do stuff with the results
});

You will at that point need to know the index of the column you are interested in (i.e. if you have the columns time, machine, memory_used and want the last one, it's 2) and the index of the row you want to use (alternative would be to iterate over all results).

For example, to simply display the three values I mentioned for the first row of the results:

var myResults = search.data("results"); // get the data from that search
myResults.on("data", function() {
    resultArray = myResults.data().rows;
    alert("At " + resultArray[0][0] + ", Machine " + resultArray[0][1] + " used " + resultArray[0][2] + " KB Memory");
});

PS: You obviously need to assign your search manager a name to use it, i.e. change your line where you create the search manager to

var search = new SearchManager(...

[josefa123]

data is undefined

[jeffland]

Did you make sure that search is your search manager?

[josefa123]

yep. And I think the culprit here is the real time search. But I need to retain it to get the latest results without refreshing the dashboard everytime.

[jeffland]

Ah. Yes, with real-time searches, the results model is accessed differently - you need the "preview" data, not the "results", as explained here.

So to get it working, you would do it like this:

var myResults = search.data("preview"); // get the data from that search
myResults.on("data", function() {
    resultArray = myResults.data().rows;
    // do stuff with the results
});

Sorry that I missed that your search is a real time search.

[josefa123]

Thank you so much. It worked! 🙂