SplunkJS search results: on('data', ...) - when is it fired?

[jeffland]

Hello.

In my app, I have some searchmanagers (most of them using tokens from timepickers and a multiselect) and charts, created in Simple XML with the Web UI. I would like to replace one of the charts with a custom visualization, so in my Javascrip I have this code to get the results from the search manager:

var search = splunkjs.mvc.Components.getInstance("search1");
var myResults = search.data("results", {count: 0});
var resultArray = [];
var searchresult_tags = [];
var searchresult_weight = [];

myResults.on("data", function() {
    console.log("fired"); // to see when this event is fired
    // Fill two arrays with results (tags and weight)
    resultArray = myResults.data().rows; // <- this line
    for (i = 0; i < resultArray.length; i++) {
        searchresult_tags[i] = resultArray[i][0];
        searchresult_weight[i] = parseInt(resultArray[i][1]);
        // do something with arrays to prepare for visualisation
    }  
});

Unfortunately, I get errors with this simple code. When the page loads, the console prints Kein Element gefunden (German for no element found) at Results:1:1, which is an object (or file?) I didn't create (I assume this is an object from the searchmanager or something related). I can sometimes see that the content of this object is {"preview":false,"init_offset":0,"messages":[],"fields":["...","_tc"],"rows":[["..."]]}, so it looks like some JSON containing my results (I shortened the content of the fields and rows arrays here; they contain the correct results). Sometimes, this object is completely empty however, and I haven't figured out yet what governs this behavior. In any case, I then get another error on the console directly after that saying TypeError: myResults.data(...) is undefined at the line indicated in the sample above; this error is also logged in Splunks _internal index. After that, the console shows my "fired" log.

I was under the impression that the on('data', ...) event is fired once, when the searchmanager completes the search, and the data().rows are accessible. It appears that this event is fired more than once though, as I sometimes get up to three "fired" console logs (and accompanying errors).

I have tried these ideas which bettered the situation somewhat:
a) I have created a minimal working example of an app containing only one chart and searchmanager (also using a token, this time from a dropdown), and then added the exact same functionality in JS. With this app, I rarely get the errors, but they still happen (once in 25 searches or so).
b) Adapted from the example in the tutorial to add a D3 visualisation at http://dev.splunk.com/view/webframework-splunkjsstack/SP-CAAAEN6, I have added the following code right before the indicated line:

if (!myResults.hasData()) {
    return;
}

This prevents the JS TypeError, but I still get the "No element found" error.

Option a) is obviously not a solution, but it suggests that this problem may be related to the number of searchmanagers. Option b) offers a slight improvement as the error is only logged on the console, but I can't imagine that this is the official way to do it. Why does the event fire if there is no data?

So my questions are: what is the expected behavior of on('data', ...), i.e. when is it fired? I have been unable to find the documentation covering this event. Furthermore, is there something else I am doing wrong, or could this be caused by something I haven't thought of?

Any input is much appreciated.

---

Update:

This is my minimal example script code:

var search = splunkjs.mvc.Components.getInstance("search1");
var myResults = search.data("results");
// var myResults = search.data("results", {count: 250}) // alternative variant
var resultArray = [];

myResults.on("data", function() {
    resultArray = myResults.data().rows;
    console.log("fired");
});

In this minimal app, there is a single view with a single table, the search that delivers the results takes a token from one dropdown. The search takes quite some time to complete, and I can see the progress on the progress bar in the table. Whenever the bar progresses, the console shows the two errors, so I suppose the on('data', ...) is somehow also called when the search progresses (possibly when it fires a search:progress event?). Interestingly, the "fired" log entry is only written once, when the search is completed.

[vganjare]

HI,

Can you please try changing 2nd line to following:

var myResults = search.data("results");

on("data") will be fired if the search returns the valid result (i.e. atleast 1 event).

Thanks!!

[jeffland]

I don't understand why, but this works. Thanks!

edit:
Hm. On second try, it doesn't.

[vganjare]

Can you please share the final code?

Thanks!!

[jeffland]

I have added it to the question because I think it is highly relevant, so please see above.

[harithivakarnad]

@jeffland did you find answer for the above question,because me too facing the same issue.

[jeffland]

Unfortunately, no. But I rarely get the error these days and have grown accustomed to using the hasData() function to write more robust code.

[harithivakarnad]

Actually I am facing a situation where i need to display results from a search to modal and I am a newbie in javascript so can you please help me with below code. ?

var mysearch=splunkjs.mvc.Components.getInstance("search1");
var myResults = mysearch.data('results',{
output_mode: 'json',
count: 0
});
var resultdata=[];
myResults.on("data",function(){
resultdata=myResults.collection().toJSON();
});

Note: Need the data array to be loaded in resultdata.

[jeffland]

First of all, use the formatting here to enter code - a blank line and four spaces for longer blocks, single ticks for inline.
Have you had a look at the resultdata object? Your results are in there, all you have to do is create a modal and insert the right content from that object. You should ask a new question for specific questions.

[harithivakarnad]

Yes I have checked the resultdata object and it has no content. It is an empty object.

[jeffland]

Post your code in a new question, and explain what you want to achieve.

[harithivakarnad]

Sure. Thanks !!!