Dashboards & Visualizations

Is it possible to get the time it took to search from a SearchManager?

d044160
Explorer

I'm coding some custom dashboards and I have javascript code:

var searchMan = new SearchManager({
    "id": "search",
    "search": mvc.tokenSafe('*'),
    "earliest_time": "-10m@m", 
    "latest_time": "now",
    "preview": true,
    "cache": false,
    "autostart": false
});

var res = searchMan.data("results");
res.on("data", function() {
    console.log(res.data());
});

How do I fetch the time it took Splunk to search from res?

Any help appreciated, thanks!

1 Solution

d044160
Explorer

I was looking for a way to do it in JS. But thanks anyway. Just for the record, finally I came up with this, which is exactly what I needed:

searchManager.on('search:done', function(properties) {
     var duration = properties.content.runDuration;
     // ...

View solution in original post

d044160
Explorer

I was looking for a way to do it in JS. But thanks anyway. Just for the record, finally I came up with this, which is exactly what I needed:

searchManager.on('search:done', function(properties) {
     var duration = properties.content.runDuration;
     // ...

lmyrefelt
Builder

nice, thanks for sharing! Will come in handy 🙂

lmyrefelt
Builder

It should be printed to search.log (and accessible from "Job-Inspector" in the UI ) ... possible inside one of the log files .. for sure in the information under $SPLUNK_INSTALL/var/run/splunk/dispatch/

0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...